2026 Actual Cisco 350-401 Dumps, Updated Exam Questions for Guaranteed Pass

350-401 free sample questions and answers

Cisco 350-401 practice quiz with correct answers for search indexing.

1. Question 1

   What do Cisco DNA southbound APIs provide?

   Ainterface between the controller and the network devices
   

   Binterface between the controller and the consumer
   

   CNETCONF API interface for orchestrator communication
   

   DRESTful API interface for orchestrator communication
   

   Correct answer: A

   The correct answer is A. interface between the controller and the network devices.

   In Cisco controller-based architectures such as Cisco DNA Center / Cisco Catalyst Center, APIs are generally described in two directions:

   Northbound APIs used by external applications, users, or orchestration systems to communicate with the controller

   Southbound APIs used by the controller to communicate with the network devices

   Why A is correct:

   A southbound API provides the communication path between the controller and the infrastructure devices such as switches, routers, and wireless devices. This is how the controller pushes configuration, collects operational data, and manages the network.

   Why the other options are incorrect:

   B . interface between the controller and the consumer

   This describes a northbound API, not a southbound API.

   C . NETCONF API interface for orchestrator communication

   Orchestrator communication is generally associated with northbound integration, not the fundamental definition of Cisco DNA southbound APIs.

   D . RESTful API interface for orchestrator communication

   This also describes northbound API behavior, where external systems communicate with the controller.

   Final ENCOR Exam Tip:

   Remember this controller model clearly:

   Northbound API = controller applications / orchestration / users

   Southbound API = controller network devices

   Southbound = toward the infrastructure

   
   

2. Question 2

   Refer to the exhibit.

   

   AOnly the server can initiate communication.
   

   BOnly the database can initiate communication.
   

   CThe server and the database cannot communicate.
   

   DThe server and the database can initiate communication.
   

   Correct answer: B

   The correct answer is B. Only the database can initiate communication.

   Key Configuration Analysis:

   From the exhibit:

   ip nat inside source static 10.1.2.100 interface GigabitEthernet0/1

   * Inside local (DB): 10.1.2.100

   * Inside global (translated IP): 10.50.250.1 (Gi0/1 interface)

   * NAT type: Static NAT

   Important Behavior of Static NAT:

   * Static NAT creates a permanent one-to-one mapping between inside local and inside global IP.

   * It allows bidirectional communication, but only if traffic is properly addressed.

   Critical Detail in the Questio n:

   * The server initiates the connection

   * The server expects the DB to appear as 10.50.250.0/24 (translated network)

   What Actually Happens:

   1. The server sends traffic to 10.50.250.1 (inside global IP).

   1. The router translates:

   o Destination 10.1.2.100 (DB)

   2. DB receives the request and responds.

   3. Return traffic is translated back to 10.50.250.1

   However:

   * The NAT rule only defines source translation for traffic originating from inside (DB).

   * It does not fully support proper session handling when initiated from outside unless routing/NAT symmetry is correct.

   * In this topology, the expectation and flow mismatch causes only inside-initiated sessions to work reliably.

   Result:

   * The database (inside) can initiate connections outward using NAT

   * The server (outside) initiating may fail due to NAT direction and expectation mismatch

   Why Other Options Are Incorrect:

   * A. Only the server can initiate communication

   Incorrect --- NAT favors inside-initiated traffic.

   * C. No communication possible

   Incorrect --- inside-initiated traffic still works.

   * D. Both can initiate communication

   Incorrect --- would only be true with correct bidirectional NAT design.

   Final ENCOR Exam Tip:

   * Static NAT = bidirectional mapping, BUT

   * Always check:

   o Who initiates traffic

   o Which side is inside vs outside

   o Whether NAT rules match expected traffic flow

   Exam trick:

   If NAT is configured as inside source, it primarily supports inside outside initiation.

   
   

3. Question 3

   Which data is properly formatted with JSON?

   

   AOption A
   

   BOption B
   

   COption C
   

   DOption D
   

   Correct answer: C

   Proper JSON Data Format:

   JSON (JavaScript Object Notation) has specific formatting rules that distinguish valid from invalid JSON:

   • Data Types Supported: Strings (in double quotes), numbers, booleans (true/false), null, objects {}, and arrays []
   • String Quotes: All string keys and values must use double quotes ('), not single quotes
   • Key-Value Pairs: In objects, keys must be strings in double quotes, followed by a colon, then a value: 'key': 'value'
   • Commas: Elements in arrays and properties in objects must be separated by commas, with no trailing comma after the last element
   • No Comments: JSON does not support comments; any comment syntax makes it invalid
   • Valid Example:

     {
       'name': 'John',
       'age': 30,
       'active': true,
       'hobbies': ['reading', 'gaming']
     }

   • Invalid Examples: Single quotes, unquoted keys, trailing commas, or comments will fail JSON validation
   • Whitespace: Whitespace around colons and commas is allowed but not required

4. Question 4

   Which security mechanism is offered on a next-generation firewall but not on a traditional firewall?

   Aintegrated IPS
   

   Bstateful firewall policies
   

   CSSL VPN
   

   DNAT
   

   Correct answer: A

   The correct answer is A. integrated IPS.

   Key Concept (NGFW vs Traditional Firewall):

   A traditional firewall provides:

   Stateful inspection

   Basic ACL filtering

   NAT

   Sometimes VPN services

   A Next-Generation Firewall (NGFW) adds advanced capabilities such as:

   Integrated Intrusion Prevention System (IPS)

   Application awareness and control

   Advanced malware protection

   Why A is correct:

   Integrated IPS (Intrusion Prevention System) is a defining feature of NGFWs.

   It allows the firewall to:

   Detect and block known and unknown threats

   Perform deep packet inspection

   Stop attacks in real time

   This capability is not part of traditional firewalls, which only inspect traffic based on state and basic rules.

   Why the other options are incorrect:

   B . Stateful firewall policies

   This is a core feature of traditional firewalls, not unique to NGFWs.

   C . SSL VPN

   VPN functionality exists in both traditional and next-generation firewalls.

   D . NAT

   NAT is a basic firewall/network feature, not exclusive to NGFWs.

   Final ENCOR Exam Tip:

   Remember the distinction:

   Traditional Firewall Stateful filtering, NAT, VPN

   Next-Generation Firewall Adds IPS + Application Awareness + Advanced Security

   NGFW = Traditional Firewall + Advanced Threat Protection

   
   

5. Question 5

   SIMULATION

   

   

   ASee the solution below in Explanation
   

   Correct answer: A

   Solution:

   R3

   Config#int et0/1

   config-if#ip ospf priority 255

   wr

   R20

   clear ip ospf process

   yes

   R10

   int et0/0

   ip ospf priority 0

   wr

   R2

   clear ip ospf process

   yes