Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Refer to the exhibit.

Refer to the exhibit. Based on this JSON response:

Which Python statement parses the response and prints "10:42:36.111 UTC Mon Jan 1 2024"?

To parse a JSON response and extract a specific timestamp value in Python:
The correct statement would typically follow this pattern:
import json data = json.loads(response) # or response = requests.get(...).json() print(data['key']['nested_key']['timestamp'])
Without seeing the specific JSON exhibit structure, the answer would access the timestamp field through the appropriate nested dictionary keys. For example, if the JSON has a structure like {'data': {'timestamp': '10:42:36.111 UTC Mon Jan 1 2024'}}, the statement would be: print(data['data']['timestamp'])
In which two ways does PIM dense mode function in the network? (Choose two.)
PIM Dense Mode functions in two primary ways:
These characteristics make Dense Mode suitable for networks with dense multicast group membership and high-bandwidth multicast sources.
Which two namespaces does the LISP network architecture and protocol use? (Choose two.)
The LISP network architecture and protocol use two distinct namespaces: (1) the Identity namespace, which uses Endpoint Identifiers (EIDs) to identify devices and services, and (2) the Locator namespace, which uses Routing Locators (RLOCs) to identify where packets are sent in the network. This separation of identity from location is the core principle of LISP.
Refer to the exhibit.

Refer to the exhibit. What is determined from the output?
Without access to the specific exhibit referenced, common determinations from JSON API output include:
To provide a specific answer, the exhibit would need to be analyzed to determine what specific conclusion or determination can be made from its output. Common determinations involve validating successful API calls, identifying returned data fields, or confirming the status of network operations.
Exhibit.

Security policy requires all idle-exec sessions to be terminated in 600 seconds. Which configuration achieves this goal?
To terminate idle-exec sessions in 600 seconds, the configuration command exec-timeout 600 (or exec-timeout 10 0 for 10 minutes) must be applied to the relevant line (console, vty, etc.). This command sets the idle session timeout in minutes and seconds, automatically disconnecting sessions that exceed the threshold.
A network administrator prepares to deploy a new software-defined fabric across campuses. What is needed to ensure success for the overall design?
The correct answer is C. A point-to-point Layer 3 underlay network with jumbo frames enabled.
In Cisco SD-Access, the fabric is built on top of an underlay network. Cisco documentation states that the SD-Access underlay uses a structured Layer 3 foundation and a Layer 3 routed access design, where the network elements establish IP connectivity through routing rather than relying on Layer 2 adjacency. Cisco Catalyst Center LAN automation documentation also describes the underlay links as point-to-point Layer 3 routed connections.
This makes Option C the best answer because it matches the recommended SD-Access design approach:
Point-to-point Layer 3 links in the underlay
Routed access instead of Layer 2 campus meshing
Jumbo frames enabled to accommodate encapsulation overhead commonly associated with fabric technologies such as VXLAN in software-defined fabrics, which is a standard design consideration in Cisco fabric deployments.
Why the other options are incorrect:
A . A fully meshed Layer 2 topology
This is not the SD-Access design model. Cisco SD-Access is not based on a campus-wide Layer 2 mesh; instead, it uses a routed Layer 3 underlay.
B . A fully meshed Layer 3 topology
SD-Access does require Layer 3 underlay connectivity, but not a fully meshed Layer 3 topology. Cisco recommends a structured routed access design, not an every-device-to-every-device full mesh.
D . A point-to-point Layer 2 network with LACP between devices for redundancy
This contradicts the SD-Access underlay principle. The underlay should be Layer 3 point-to-point, not Layer 2 point-to-point.
ENCOR exam point:
For Cisco SD-Access, remember this core design rule:
Underlay = routed, point-to-point, Layer 3 foundation
Overlay = virtualized fabric services on top of that underlay
Exam domains verified against: Official Cisco 350-401 exam guide, last checked September 2026.
Enterprise network design spans traditional hierarchies, fabric architectures, and cloud deployments. High availability requires understanding redundancy techniques including First Hop Redundancy Protocols and Stateful Switchover mechanisms to minimize downtime.
Sample question from this domain above: Q3
Device virtualization distinguishes between Type 1 and Type 2 hypervisors and covers virtual machines and switching. Data path virtualization using VRF, GRE, and IPsec tunneling enables logical network segmentation and secure communication across physical infrastructure.
Sample question from this domain above: Q6
Layer 2 troubleshooting covers trunking protocols and EtherChannel configuration with Spanning Tree enhancements for loop prevention. Layer 3 focuses on OSPF and EIGRP routing dynamics, eBGP configuration, and First Hop Redundancy Protocols alongside NAT, NTP, and multicast routing.
Diagnostic tools including debugs, traceroute, ping, SNMP, and syslog enable systematic troubleshooting of network problems. Flexible NetFlow, SPAN variants, and IP SLA provide detailed visibility, while Catalyst Center offers AI-powered configuration and monitoring workflows.
Device access control uses local authentication and AAA services for secure administration. Infrastructure security includes Access Control Lists and Control Plane Policing to prevent DoS attacks, complemented by security design principles covering threat defense, endpoint protection, next-generation firewalls, and MACsec.
Python scripting and JSON data structures form the foundation for network automation. YANG data modeling, REST APIs for Catalyst Center and RESTCONF, EEM applet construction, and orchestration tool comparison enable engineers to automate configuration and troubleshooting at scale.
Common questions about the exam itself