Which wireless deployment model has lightweight access points forward client traffic through a central controller using CAPWAP tunnels?

Centralized (local-mode) deployment with a WLC

Autonomous access points with no controller

FlexConnect with all traffic switched locally

Cloud-managed access points with no tunneling

What is the primary difference between a virtual machine and a container?

Each VM runs a full guest OS on a hypervisor, while containers share the host OS kernel and package only the app and its dependencies

Containers each include a full guest operating system, while VMs share the host kernel

VMs cannot run network functions, but containers can

Containers require dedicated hardware, while VMs do not

A GRE tunnel is configured between two routers across the internet. What does GRE provide by itself?

Encapsulation of a wide range of protocols in a point-to-point tunnel, without encryption

Strong encryption and authentication of all traffic

Automatic dynamic routing without any protocol

Layer 2 switching between distant sites at line rate

Which attribute does BGP evaluate first (after next-hop reachability) when selecting the best path, and in which direction does a higher value win?

Weight, where the highest weight is preferred (Cisco-proprietary, local to the router)

MED, where the highest value is preferred

AS-path length, where the longest path is preferred

Local preference, where the lowest value is preferred

Two switches are connected by several links bundled with LACP into one logical link. What benefit does this EtherChannel provide?

Increased aggregate bandwidth and redundancy without spanning-tree blocking the redundant links

Automatic routing between VLANs without a Layer 3 device

Encryption of all frames on the bundle

Elimination of the need for a default gateway

Which statement about a VXLAN overlay used in modern campus and data-center fabrics is correct?

VXLAN encapsulates Layer 2 frames in UDP and uses a 24-bit VNID, allowing about 16 million segments

VXLAN provides only 4094 total segments, like classic VLANs

VXLAN operates purely at Layer 1 with no encapsulation

VXLAN replaces IP routing entirely in the underlay

In an 802.1X port-based authentication deployment, which device plays the role of the authenticator?

The switch or wireless controller that controls port access and relays credentials

The RADIUS server that validates credentials

The end-user client (supplicant) requesting access

Cisco CCNP Enterprise (350-401 ENCOR) Practice Test

Frequently asked questions

How many Cisco CCNP Enterprise (350-401 ENCOR) practice questions are here?+

A full bank of original Cisco CCNP Enterprise (350-401 ENCOR) practice questions across the official content areas, weighted like the real exam, with explanations. Free, no signup.

What is the Cisco CCNP Enterprise (350-401 ENCOR) exam like?+

A multiple-choice exam, 120 minutes, and you need 825/1000% to pass. Practice by topic here, then take the full timed mock exam to gauge readiness.

Are these the real exam questions?+

No. Every question is 100% original, written from public primary sources with explanations. We never copy real exam questions or paid prep material.

Can I study in Chinese or Spanish?+

PrepPass practice is in English, 中文 and Español. The official exam is in English — switch the question language to English any time to rehearse the exact terminology you'll see on test day.

Sample practice questions

A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.

1. Architecture
In a traditional three-tier enterprise campus design, which layer aggregates access-layer switches and typically enforces routing policy and redundancy between the access and core?
- a.Access layer
- b.Distribution layer
- c.Core layer
- d.Data-center spine layer
Answer: b
Explanation: The distribution layer aggregates access switches, provides Layer 3 boundaries, applies routing and policy, and offers redundancy toward the core. The access layer connects end devices, and the core provides high-speed, low-latency transport between distribution blocks. In a collapsed-core design the distribution and core functions merge.
2. Architecture
Which wireless deployment model has lightweight access points forward client traffic through a central controller using CAPWAP tunnels?
- a.Centralized (local-mode) deployment with a WLC
- b.Autonomous access points with no controller
- c.FlexConnect with all traffic switched locally
- d.Cloud-managed access points with no tunneling
Answer: a
Explanation: In a centralized local-mode deployment, lightweight APs tunnel client data and control traffic to a wireless LAN controller over CAPWAP, so the controller centralizes forwarding and policy. Autonomous APs work standalone, and FlexConnect can switch some traffic locally at the branch. CAPWAP tunneling to the WLC defines the centralized model.
3. Virtualization
What is the primary difference between a virtual machine and a container?
- a.Containers each include a full guest operating system, while VMs share the host kernel
- b.Each VM runs a full guest OS on a hypervisor, while containers share the host OS kernel and package only the app and its dependencies
- c.VMs cannot run network functions, but containers can
- d.Containers require dedicated hardware, while VMs do not
Answer: b
Explanation: A virtual machine runs a complete guest operating system on top of a hypervisor, whereas a container shares the host's OS kernel and packages just the application and its dependencies, making containers lighter and faster to start. Both can run network functions, and neither requires dedicated hardware per instance.
4. Virtualization
A GRE tunnel is configured between two routers across the internet. What does GRE provide by itself?
- a.Encapsulation of a wide range of protocols in a point-to-point tunnel, without encryption
- b.Strong encryption and authentication of all traffic
- c.Automatic dynamic routing without any protocol
- d.Layer 2 switching between distant sites at line rate
Answer: a
Explanation: Generic Routing Encapsulation creates a point-to-point virtual link that can carry many passenger protocols, but it does not encrypt or authenticate traffic on its own; it is commonly paired with IPsec when confidentiality is required. GRE does not itself provide dynamic routing or Layer 2 switching.
5. Infrastructure
Which attribute does BGP evaluate first (after next-hop reachability) when selecting the best path, and in which direction does a higher value win?
- a.Weight, where the highest weight is preferred (Cisco-proprietary, local to the router)
- b.MED, where the highest value is preferred
- c.AS-path length, where the longest path is preferred
- d.Local preference, where the lowest value is preferred
Answer: a
Explanation: On Cisco routers the first tie-breaker in BGP best-path selection is Weight, which is local to the router and prefers the highest value. Local preference (higher preferred) comes next and is exchanged within the AS, while a shorter AS-path is preferred and a lower MED is preferred later in the process.
6. Infrastructure
Two switches are connected by several links bundled with LACP into one logical link. What benefit does this EtherChannel provide?
- a.Increased aggregate bandwidth and redundancy without spanning-tree blocking the redundant links
- b.Automatic routing between VLANs without a Layer 3 device
- c.Encryption of all frames on the bundle
- d.Elimination of the need for a default gateway
Answer: a
Explanation: An EtherChannel bundles multiple physical links into one logical link, increasing aggregate bandwidth and providing redundancy, and because STP treats the bundle as a single link the member links are not individually blocked. It does not perform inter-VLAN routing, encryption, or remove the need for a gateway.
7. Infrastructure
Which statement about a VXLAN overlay used in modern campus and data-center fabrics is correct?
- a.VXLAN provides only 4094 total segments, like classic VLANs
- b.VXLAN encapsulates Layer 2 frames in UDP and uses a 24-bit VNID, allowing about 16 million segments
- c.VXLAN operates purely at Layer 1 with no encapsulation
- d.VXLAN replaces IP routing entirely in the underlay
Answer: b
Explanation: VXLAN encapsulates Ethernet frames inside UDP/IP (MAC-in-UDP) and uses a 24-bit VXLAN Network Identifier, providing roughly 16 million segments, far beyond the 4094 of 802.1Q VLANs. It rides on top of a routed IP underlay rather than replacing it, enabling scalable Layer 2 overlays across a Layer 3 network.
8. Security
In an 802.1X port-based authentication deployment, which device plays the role of the authenticator?
- a.The switch or wireless controller that controls port access and relays credentials
- b.The RADIUS server that validates credentials
- c.The end-user client (supplicant) requesting access
- d.The DNS server resolving names
Answer: a
Explanation: In 802.1X, the authenticator is the network access device, typically a switch or WLC, that controls port access and relays authentication messages between the supplicant and the authentication server. The supplicant is the client requesting access, and the authentication server (usually RADIUS) makes the accept or reject decision.
9. Security
Which management access method should be preferred over Telnet to administer a device securely?
- a.HTTP
- b.SNMPv1
- c.Telnet on a nonstandard port
- d.SSH
Answer: d
Explanation: SSH encrypts the management session, protecting credentials and commands, and should be used instead of Telnet, which sends everything in clear text. Moving Telnet to a nonstandard port does not add encryption, HTTP is likewise unencrypted, and SNMPv1 has weak security; SNMPv3 and SSH are the secure choices.
10. Automation
Which programmatic interface uses YANG data models and typically runs over SSH to configure and retrieve state from network devices?
- a.SNMPv2c
- b.Syslog
- c.NETCONF
- d.ICMP
Answer: c
Explanation: NETCONF is a network management protocol that uses YANG data models and runs over SSH, exchanging configuration and state as structured XML. RESTCONF offers a similar model over HTTP. SNMP is an older management protocol, syslog carries log messages, and ICMP is for diagnostics, none of which use YANG.