350-401 Cisco Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) v1.2 Free Practice Exam Questions (2026 Updated)

The correct command is login under line con 0. In classic Cisco IOS line authentication, setting a line password alone is not enough; the login command tells IOS to prompt for and validate the configured line password. The exhibit shows console line configuration with a password configured, and AAA is not enabled. Therefore, line con 0 followed by login enables console password checking using only the line password. Option A only disables console session timeout by setting the exec timeout to zero; it does not enable authentication. Option C, login local, tells IOS to authenticate against the local username database, which requires a username and password, not only the line password. Option D applies the setting to VTY lines, which control remote Telnet/SSH access, not the physical console line. This is a fundamental device-hardening and management-plane access-control concept. For ENCOR, candidates must distinguish line passwords, local username authentication, AAA authentication, console lines, and VTY lines. References/topics: ENCOR Infrastructure Security, console access, line password, login, login local, local authentication, device administration.

The correct answer is B. TLS.

In Cisco Catalyst SD-WAN, the architecture separates:

Control Plane → Secure communication between controllers and edge devices

Data Plane → Encrypted tunnels carrying user traffic

The control plane (between vSmart, vBond, vManage, and WAN Edge routers) uses:

TLS (Transport Layer Security)

In some cases also DTLS, depending on configuration

These protocols provide:

Authentication

Encryption

Integrity protection

Thus, TLS is used to establish secure control plane adjacencies.

A. IPsec Used for data plane encryption (IPsec tunnels), not control plane.

C. IKE Used for key exchange in IPsec, not for SD-WAN control plane adjacencies.

D. ESP Part of IPsec (data plane encryption), not control plane.

Memorize this SD-WAN separation:

Control Plane → TLS / DTLS

Data Plane → IPsec (ESP encapsulation)

This distinction is frequently tested in ENCOR exams.

Solution:

VERIFICATION: -

OR

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:

Copy run start

Verification:

OR

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Solution:-

Copy run start

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr