350-401 Cisco Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) v1.2 Free Practice Exam Questions (2026 Updated)

The correct answer is A. The script retrieves device information by sending HTTP requests to the device ' s API endpoints.

The script uses the Python requests library:

response = requests . get( url )

This sends an HTTP GET request to:

http:// < device_ip > /api/device/info

This indicates communication with a REST API endpoint exposed by the network device.

Builds a URL using the device IP

Sends an HTTP GET request to the API

Checks if the response status code is 200 (OK)

If successful:

return response . json()

→ Converts the API response into a Python dictionary

Prints the retrieved device information

The script is clearly performing a read operation (GET)

It interacts with a REST API

It retrieves device information, not configuring anything

B. Configures device settings via secure connection ❌ No POST/PUT/PATCH methods are used ❌ No HTTPS or authentication shown

C. Establishes SSH connection ❌ No SSH libraries (like Paramiko or Netmiko) are used

D. Parses JSON into tabular structure ❌ It only returns and prints JSON ❌ No formatting (like pandas/table conversion) is performed

requests.get() → Retrieve data (READ)

requests.post() / put() → Modify or create data

.json() → Converts API response into Python dictionary

Key takeaway:

REST API + GET request = data retrieval from device

Cisco TrustSec classifies traffic using Security Group Tags, commonly called SGTs. An SGT represents the security group identity assigned to a user, device, or endpoint session. Instead of relying only on VLANs, IP subnets, or ACLs tied to topology, TrustSec allows policy to follow the identity of the endpoint. That makes option B correct. VLAN-based classification is less flexible because VLANs are tied to Layer 2 segmentation and network placement. MAC addresses can identify devices but are not the TrustSec policy classification mechanism. IP addresses are commonly used in traditional ACLs, but TrustSec’s purpose is to reduce dependence on IP-based segmentation by using group-based policy. Once traffic is tagged with an SGT, network devices can enforce Security Group ACLs, also called SGACLs, based on source and destination security groups. This supports scalable segmentation across campus and enterprise networks. The ENCOR concept is identity-based segmentation and policy abstraction. References/topics: ENCOR Security, Cisco TrustSec, Security Group Tag, SGACL, identity-based access control, scalable group-based segmentation.

The correct answer is D.

To meet the requirement, the configuration must do two things:

Permit only the 10.10.10.0/24 subnet to access the VTY lines

Allow only a secure remote access protocol, which is SSH

The correct Cisco IOS configuration is:

access-list 23 permit 10.10.10.0 0.0.0.255

line vty 0 15

access-class 23 in

transport input ssh

access-list 23 permit 10.10.10.0 0.0.0.255 This correctly matches the subnet 10.10.10.0/24 using the proper wildcard mask 0.0.0.255.

line vty 0 15 This applies the restriction to all VTY lines, not only a subset.

access-class 23 in This filters incoming remote access connections to the router.

transport input ssh This allows only SSH, which is encrypted and secure, and prevents Telnet or other clear-text remote access protocols.

A is incorrect because:

access-class 23 out filters outbound connections from the VTY lines, not inbound management access.

transport input all allows insecure protocols such as Telnet.

B is incorrect because:

255.255.255.0 is a subnet mask, not a wildcard mask, so the ACL syntax is wrong for a standard ACL entry.

C is incorrect because:

It applies only to VTY 0 4, while the router also has VTY 5 15 configured.

This leaves other VTY lines unrestricted, which does not fully meet the requirement.

For secure remote management on Cisco devices:

Use transport input ssh to disable Telnet

Use access-class <</b> ACL > in on VTY lines to restrict who can connect

Use the correct wildcard mask for the subnet

For 10.10.10.0/24, the wildcard mask is:

0.0.0.255

So the complete secure solution is:

restrict inbound VTY access + allow only SSH + apply to all VTY lines