Free 350-401 Practice Questions – 2026 Updated

In the Internet Group Management Protocol version 2 (IGMPv2), a multicast router acting as the querier periodically sends a General Query message to discover which multicast groups have active members on a directly attached network. To ensure this query reaches every multicast-capable host on the local segment, it is sent to the destination IP address 224.0.0.1. This is the IANA-reserved "All Hosts" multicast address. All hosts that support IP multicasting are required to join this group on all their multicast-capable interfaces. This mechanism allows the querier to efficiently solicit Membership Report messages from any host interested in any multicast group.

A. 239.0.0.2: This address is in the administratively scoped multicast range ("limited scope") and is not used for fundamental network control protocols like IGMP.

C. 239.0.0.1: Similar to 239.0.0.2, this is an administratively scoped address intended for private multicast applications, not for IGMP control plane messages.

D. 224.0.0.2: This is the "All Routers" multicast address, used for communication between multicast routers (e.g., PIM, OSPF), not for querying hosts.

1. Internet Engineering Task Force (IETF) RFC 2236: Internet Group Management Protocol

Version 2.

Section 2

"Protocol Description

" Paragraph 2: "Queries are sent with a destination IP address of 224.0.0.1 (the all-hosts group)."

DOI: https://doi.org/10.17487/RFC2236

2. Cisco Systems

Inc.: IP Multicast: IGMP Configuration Guide

Cisco IOS XE Gibraltar 16.12.x.

Chapter: "Configuring IGMP

" Section: "IGMPv2

" Subsection: "Query-Response Process": "The querier periodically sends a general IGMP query to the all-hosts multicast group address 224.0.0.1."

3. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Chapter 4

Section 4.4.2

"IP Multicasting: The Internet Group Management Protocol (IGMP)": This standard university textbook explains that IGMP query messages are sent to the all-systems multicast address 224.0.0.1.

The principle of separation of privilege, also known as the principle of least privilege, is a fundamental security design concept for any system, including REST APIs. It dictates that a client (user, service, or application) should only be granted the minimum set of permissions required to perform its specific, authorized tasks. In the context of a REST API, this means carefully designing roles and access controls so that a consumer can only access the specific endpoints and perform the specific actions (e.g., GET, POST, DELETE) necessary for its function, thereby minimizing the potential attack surface and the impact of a compromised key or token.

B. password hashing: This is a specific cryptographic technique used to securely store credentials. It is an implementation detail, not a high-level architectural design principle for an API.

C. confidential algorithms: This concept, known as "security through obscurity," is an anti-pattern in security design. Robust security relies on public, well-vetted algorithms combined with private, well-managed keys.

D. OAuth: This is a specific authorization framework or protocol. While it is commonly used to secure REST APIs, it is a mechanism to implement security principles like separation of privilege, not the principle itself.

1. National Institute of Standards and Technology (NIST)

Special Publication 800-204A

Building Secure Microservices-based Applications Using Service-Mesh Architecture

December 2019.

Reference: Section 3.1

"Security Principles

" explicitly lists "Least Privilege" as a core principle. It states

"The principle of least privilege requires that a user

process

or component should be given only the minimum privileges essential to perform its intended function." This is directly applicable to API security design.

2. OWASP Foundation

OWASP API Security Top 10 2023.

Reference: The top two vulnerabilities

"API1:2023 - Broken Object Level Authorization" and "API2:2023 - Broken Authentication

" and "API5:2023 - Broken Function Level Authorization" are all fundamentally about failures to correctly implement the principle of least privilege/separation of privilege at different layers of the API.

3. Cisco

Cisco ENCOR 350-401 Official Cert Guide

Volume 2

1st Edition.

Reference: Chapter 23

"Network Security and Monitoring

" discusses access control principles. While not specific to REST

it covers the foundational concept of authorization

which is the mechanism for enforcing separation of privilege. The design of authorization policies for a REST API is directly guided by this principle.

This Cisco Embedded Event Manager (EEM) applet is designed to periodically check for a specific MAC address and shut down the interface where it is found. The script components work together to automate this security action. event timer watchdog time 10: This command configures the trigger for the applet. The watchdog keyword specifies a recurring timer that will execute the applet's actions every 10 seconds. This is the correct timer type for periodic, repeated checks. 2. action 04 regexp "(Gi...)" ...: This action processes the output from the show mac address-table command. The goal is to find the port associated with the MAC address. A regular expression (regexp) is used to match and capture the interface name. The pattern (Gi...) will match any string starting with "Gi" (e.g., GigabitEthernet0/1), and the parentheses () capture this matched string for later use (in action 07). 3. action 05 if $_regexp_result eq 1: This action creates a conditional block. After the regexp action runs, the special EEM variable $_regexp_result is automatically set. It is set to 1 if the regular expression found a match and '0' otherwise. Therefore, if $_regexp_result eq 1 is the correct syntax to execute the subsequent shutdown commands only if the MAC address was found in the table.

Cisco Systems, "Embedded Event Manager Configuration Guide,

Cisco IOS XE": This official guide details the commands and variables for

EEM applets.

o event timer watchdog: The guide describes the watchdog timer as

a "recurring, system-clock-based timer," confirming its use for

periodic execution. (Reference: Chapter: "Writing Embedded Event

Manager Policies," Section: "Configuring an Event Statement").

o action regexp and $_regexp_result: The documentation specifies

that the $_regexp_result built-in variable is set to "1" on a

successful pattern match and "0" on a failure, validating the

conditional if statement. (Reference: Chapter: "Writing Embedded

Event Manager Policies," Section: "EEM Built-In Variables").

o Regular Expression Pattern Matching: The use of parentheses ()

for capturing substrings in a regexp action is standard EEM

functionality, confirming that (Gi...) is used to capture the interface

name. (Reference: Chapter: "Writing Embedded Event Manager

Policies," Section: "Configuring an EEM Policy Action").

In the Cisco Catalyst 9800 Wireless Controller's New Configuration Model, the policy tag is the component that links a specific WLAN Profile to a Policy Profile. The WLAN Profile defines the SSID, while the Policy Profile defines the properties applied to that WLAN, such as VLAN assignment, Quality of Service (QoS) policies, session timeouts, and Access Control Lists (ACLs). By associating a WLAN with a policy profile, the policy tag effectively defines the complete set of properties for that specific WLAN, which is then applied to Access Points (APs) that are assigned that tag.

A. RF tag: This tag assigns radio-frequency (RF) profiles to APs, controlling parameters like data rates, power levels, and channel assignments, not WLAN-specific network policies.

C. AP tag: This is not a specific tag type within the Cisco 9800 configuration model. The model uses Policy, Site, and RF tags, which are assigned to APs.

D. site tag: This tag links APs to site-specific settings, such as an AP Join Profile (e.g., CAPWAP timers) or a FlexConnect Profile, which are not WLAN-specific properties.

1. Cisco Systems

Inc. (2023). Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide

Cisco IOS XE Cupertino 17.9.x. Chapter: "Configuring Tags and Profiles"

Section: "Information About Tags".

This document states

"Policy Tag: The policy tag is the link between a WLAN profile and a policy profile. The policy tag determines which WLANs are broadcasted on an AP

and what policies are applied for a specific WLAN."

2. Cisco Systems

Inc. (2023). Catalyst 9800-L Wireless Controller Data Sheet. Section: "Cisco Catalyst 9800 Series Wireless Controllers".

The data sheet describes the tag-based configuration: "The new configuration model... allows for a logical grouping of APs based on tags. Tags can be defined based on physical location

geography

or AP function. This allows for a much more simplified and intuitive configuration experience... The tags that can be defined are the policy tag

site tag

and RF tag." This confirms the three valid tag types and their purpose in grouping and applying policies.

below Explanation: Task 1: Flexible NetFlow Exporter Configuration This configuration creates a NetFlow exporter on router R1 to send traffic flow data to a collector at 10.10.1.10. Cisco CLI R1(config)# flow exporter NETFLOW_EXPORT R1(config-flow-exporter)# destination 10.10.1.10 R1(config-flow-exporter)# source Loopback0 R1(config-flow-exporter)# transport udp 2055 ! R1(config)# flow monitor NETFLOW_MONITOR R1(config-flow-monitor)# record netflow-original R1(config-flow-monitor)# exporter NETFLOW_EXPORT R1(config-flow-monitor)# cache timeout active 60 ! R1(config)# interface [interface_name] R1(config-if)# ip flow monitor NETFLOW_MONITOR input Explanation: First, a flow exporter is defined, specifying the collector's IP address (destination 10.10.1.10). A source interface (e.g., Loopback0) is best practice for stability. Next, a flow monitor is created to link a flow record template (here, the predefined netflow-original) with the exporter. Finally, the flow monitor is applied to an interface in the desired direction (e.g., input) to begin monitoring traffic. Task 2: Switch Port Analyzer (SPAN) Configuration This configuration sets up a SPAN session on switch Sw1 to mirror all traffic from PC1 and PC2 to interface E1/0. (Note: The specific source interfaces for PC1 and PC2, e.g., E0/1 and E0/2, are assumed as they are not provided in the text). Cisco CLI Sw1(config)# monitor session 2 source interface [PC1_interface] , [PC2_interface] both Sw1(config)# monitor session 2 destination interface E1/0 Explanation: A SPAN session, also known as port mirroring, copies traffic from source ports to a destination port. The command monitor session 2 creates the specified session. The source interface command defines the ports to be monitored; the keyword both ensures traffic is captured in both ingress and egress directions. The destination interface command specifies where the mirrored traffic will be sent. Task 3: IP SLA HTTP GET Configuration This configuration creates an IP Service Level Agreement (SLA) operation on router R1 to send an HTTP GET request to the server at 10.10.1.100 every 600 seconds. Cisco CLI R1(config)# ip sla 1 R1(config-ip-sla)# http-get http://10.10.1.100/ R1(config-ip-sla-http)# exit ! R1(config)# ip sla schedule 1 life forever start-time now frequency 600 Explanation: First, an ip sla operation is created with entry number 1. The operation type is defined as http-get, targeting the specified server URL. Then, the ip sla schedule command activates the operation. It is scheduled to run indefinitely (life forever), begin immediately (start-time now), and repeat every 600 seconds (frequency 600), as required by the task.

Flexible NetFlow:

o Cisco, "Flexible NetFlow Configuration Guide," IOS XE Amsterdam

17.3.x. Sections: "Configuring Flexible NetFlow" and "Components

of Flexible NetFlow".

o URL: https://www.cisco.com/c/en/us/td/docs/iosxml/ios/fnetflow/configuration/17-3/fnf-17-3-book/fnf-configuring.html

•

SPAN (Port Mirroring):

o Cisco, "Catalyst 9300 Series Switches, Cisco IOS XE Gibraltar

16.12.x - System Management Configuration Guide," Chapter:

"Configuring SPAN and RSPAN".

o URL:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/sof

tware/release/16-

12/configuration_guide/sys_mgmt/b_1612_sys_mgmt_config_guide

_c9300/configuring_span_and_rspan.html

IP SLA:

o Cisco, "IP SLAs Configuration Guide," IOS XE Gibraltar 16.12.x.

Sections: "Configuring IP SLAs HTTP Operations" and "Scheduling

IP SLAs Operations".

o URL: https://www.cisco.com/c/en/us/td/docs/iosxml/ios/ipsla/configuration/16-12/ip-sla-16-12-book/ipsla_http.html

Configuration management tools are distinguished by their approach to defining a system's configuration.

• Declarative tools, such as Puppet and Saltstack (using Salt States), focus on the desired end state. You define what the system should look like (e.g., "package 'nginx' must be installed"), and the tool's agent is responsible for figuring out how to achieve that state.
• Procedural tools, such as Chef, focus on the process. You define the specific steps and the order in which they must be executed to reach the desired state. Chef uses "recipes" written in Ruby to script this sequence of actions.

Puppet (Official Documentation):

Source: Puppet, Inc. "Puppet's Declarative Language." Puppet Enterprise 2023.4 Documentation.

Reference: In the section "How Puppet's declarative language works," the documentation states: "Puppet is a declarative, model-based configuration management solution. This means that you define the desired state of the systems in your infrastructure, and Puppet... automatically enforces that state."

Chef (Official Documentation):

Source: Progress Chef. "What is Chef Infra?" Chef Infra Documentation.

Reference: The documentation explains: "Chef Infra uses reusable definitions called 'recipes' to describe the state of your infrastructure. These recipes are written in procedural Ruby code... This procedural approach allows for great flexibility in defining configurations." While individual resources within a recipe are declarative, the recipe itself is a procedural script that is executed in order.

Saltstack (Official Documentation):

Source: Salt Project. "Understanding Salt States." Salt Project 3006.0 Documentation.

Reference: In the section "Declarative vs. Imperative," the documentation states: "Salt States are declarative. This means that a state file declares what the state of a system should be, not how to get it there... Salt determines the 'how' by using the state modules."

Task 1: This configuration modifies the existing access list on R2. The permit eigrp commands explicitly allow EIGRP (IP protocol 88) packets. The host 192.168.213.1 and host 192.168.213.3 stipulations specifically permit traffic from R1 and R3, respectively, which are R2's EIGRP neighbors according to the topology. The any destination wildcard is sufficient as the ACL is applied inbound to R2.

Task 2: This configuration implements Control Plane Policing (CoPP).

• An ACL (COPP_SSH_ACL) is created to identify SSH (TCP port 22) traffic from the 192.168.211.0/24 source network.
• A class-map (COPP_SSH_CLASS) matches traffic defined by that ACL.
• A policy-map (COPP_POLICY) defines the action for that class. The police 8000 command rate-limits the matching SSH traffic to 8,000 bps. Packets exceeding this rate are discarded by default.
• Finally, the service-policy input COPP_POLICY command applies this policy to the router's control plane.

Cisco Systems. (2020). IP Routing: EIGRP Configuration Guide, Cisco IOS XE Release 17.x. "Information About Filtering EIGRP" section. (Documents the use of permit eigrp within access lists to control routing updates).

Cisco Systems. (2021). Control Plane Policing Configuration Guide, Cisco IOS XE. "How to Configure Control Plane Policing" section. (Details the required steps of creating an ACL, class-map, policy-map with the police command, and applying it via the control-plane configuration mode).

Cisco Systems. (2019). Cisco IOS Security Configuration Guide: Security for Management Plane. "Configuring Control Plane Policing" section. (Provides examples and rationale for rate-limiting protocols like SSH to protect the CPU).

Doyle, J. & DeHaven, S. (2006). Routing TCP/IP, Volume 1 (2nd Edition). Cisco Press. Chapter 8: "EIGRP," sub-section "Route Filtering." (Explains mechanisms for filtering EIGRP, including access-lists).

Massachusetts Institute of Technology (MIT) OpenCourseWare. (2014). 6.829 Computer Networks, Lecture 15: Router Design. (Discusses the architecture of routers, including the distinction between the data plane and the control plane, which is the target of CoPP configuration).

This Python script manipulates JSON data. 1. read(): The script first opens a file and needs to read its contents into a string variable. The file object's read() method accomplishes this by reading the entire file content. 2. loads(): The json.loads() method (short for "load string") is used to parse a JSON formatted string and convert it into a Python dictionary. This allows the script to manipulate the data using Python's dictionary syntax. 3. dumps(): After modifying the IP address in the Python dictionary, the json.dumps() method (short for "dump string") serializes the Python object back into a JSON formatted string. 4. write(): Finally, the script opens a new file in write mode ("w") and uses the file object's write() method to save the newly created JSON string to the disk.

Python json module documentation: The official Python documentation

details the functions for encoding and decoding JSON. It specifies that

json.loads() is used to deserialize from a string and json.dumps() is used

to serialize to a string.

o Source: Python Standard Library, json — JSON encoder and

decoder, Sections 19.2.1 and 19.2.2.

o URL: https://docs.python.org/3/library/json.html

Python File I/O documentation: The documentation on input and output

explains that file objects created by open() have methods like read() to get

the file's contents and write() to put data into the file.

o Source: Python Tutorial, Section 7.2. Reading and Writing Files.

o URL: https://docs.python.org/3/tutorial/inputoutput.html#methods-offile-objects

In a Cisco Software-Defined Access (SD-Access) fabric, an edge node functions as the access layer switch, connecting endpoints like PCs, IP phones, and IoT devices to the fabric. Its primary responsibilities include acting as the ingress and egress point for traffic originating from or destined to these connected endpoints (A). Additionally, the edge node is responsible for the onboarding process of these endpoints, which involves performing authentication and authorization, typically using 802.1X in conjunction with Cisco ISE, to verify the endpoint's identity and assign appropriate network policies (E).

B. provides the default exit point for fabric traffic: This role is performed by a border node, which connects the SD-Access fabric to external networks (e.g., WAN, internet).

C. provides the default entry point for fabric traffic: This is also a function of a border node, handling traffic entering the fabric from an external network.

D. provides a host database that maps endpoint IDs to a current location: This is the primary function of the control plane node, which runs the LISP Map-Server and maintains the authoritative endpoint-to-locator (EID-to-RLOC) database.

1. Cisco SD-Access Solution Design Guide (CVD) - Cisco DNA Center 2.3.3

"SD-Access Fabric Roles

" Section: "Fabric Edge Nodes." This document states

"The fabric edge nodes are responsible for connecting and authenticating wired endpoints

registering the endpoint identity and location with the control plane

and applying policies to traffic to and from the endpoints." This directly supports that edge nodes authenticate endpoints (E) and

by connecting them

serve as their entry/exit points (A).

2. Cisco ENCOR 350-401 Official Cert Guide

Volume 1

1st Edition

Chapter 25

"Understanding Cisco SD-Access Architecture." The section "SD-Access Fabric Control Plane" (p. 728) explicitly states: "The control plane node... has a host tracking database (HTDB) that stores all the EID-to-RLOC mappings." This confirms that option D is a function of the control plane node

not the edge node.

3. Cisco ENCOR 350-401 Official Cert Guide

Volume 1

1st Edition

Chapter 25

"Understanding Cisco SD-Access Architecture." The section "Endpoint Onboarding" (p. 734) details the authentication process: "The endpoint connects to a port on an edge switch... The edge switch uses MAB or 802.1X to authenticate the endpoint with ISE." This confirms the edge node's role in authentication (E).

The script automates interface failover using two EEM applets:

1. Applet SRV-1-Up: Designed to activate the backup link. It monitors the primary interface (GigabitEthernet4/0/9). When the primary interface changes state to Down, the script triggers no shutdown on the backup interface (GigabitEthernet3/0/10) to bring it online.
2. Applet SRV-1-Down: Designed to deactivate the backup link when the primary recovers. It monitors the primary interface (GigabitEthernet4/0/9) changing state to up. When this occurs, the script issues the shutdown command on the backup interface to revert traffic to the primary path.

Cisco Systems, Inc., "Embedded Event Manager Configuration Guide, Cisco IOS Release 15M&T."

Chapter: "Writing Embedded Event Manager Policies Using Tcl." (Concepts apply to CLI applets).

Section: "EEM Event Detectors," specifically event syslog.

Relevance: Documents how event syslog pattern triggers actions based on matching log messages (e.g., interface state changes).

Cisco Command Reference, "Cisco IOS Network Management Command Reference."

Command: event syslog and action cli command.

Relevance: Validates the syntax used in the image (event syslog pattern "..." and action ... cli command "...").

RFC 3164, "The BSD Syslog Protocol."

Relevance: While generic, it defines the standard format of syslog messages that EEM patterns match against (e.g., timestamp, hostname, message body).

A defining feature of a Next-Generation Firewall (NGFW) is its integrated threat prevention capability, which includes an Intrusion Prevention System (IPS) and often Advanced Malware Protection (AMP). These systems primarily operate by matching network traffic against a database of known threat signatures provided by threat intelligence feeds (like Cisco Talos). This allows the NGFW to effectively identify and block signature-based malware and known exploit attempts as they traverse the firewall, a fundamental aspect of its deep packet inspection capabilities.

B. DMZ web server vulnerabilities: While an NGFW does protect DMZ web servers, this is a specific application of its broader capabilities. Option A describes the type of threat detected, which is a more fundamental function.

C. zero-day attacks: Zero-day attacks, by definition, lack a known signature. Therefore, signature-based detection, a primary method for NGFWs, is ineffective against them. Advanced sandboxing or behavioral analysis is required.

D. DDoS: NGFWs are not designed to mitigate large-scale Distributed Denial-of-Service (DDoS) attacks. Their stateful nature can make them a bottleneck and a target during a volumetric attack.

1. Cisco. (n.d.). What Is a Next-Generation Firewall (NGFW)?. Cisco. Retrieved from https://www.cisco.com/c/en/us/products/security/firewalls/what-is-a-next-generation-firewall.html.

Reference Details: Under the "Key capabilities of a Cisco NGFW" section

the document lists "Integrated intrusion prevention" and "Advanced malware protection" as core features. These features rely on signatures and threat intelligence to stop known threats.

2. Odom

W. (2020). CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide. Cisco Press. ISBN: 978-0-13-597197-0.

Reference Details: Chapter 25

"Network Security Design

" in the section "Next-Generation IPS

" explains that NGIPS (a core component of NGFW) uses signatures to identify threats. It states

"The IPS signatures can identify a large number of exploits

vulnerabilities

and other traffic that you might want to block."

3. Butt

U. A.

Mehmood

M.

Shah

S. B. H.

Amin

R.

Shaukat

M. W.

& Piran

M. J. (2020). A survey of intrusion detection systems in wireless sensor networks. Wireless Communications and Mobile Computing

2020

1-16. https://doi.org/10.1155/2020/9315925

Reference Details: Section 3

"Classification of IDSs

" discusses signature-based detection. It clarifies that this method "works against known attacks whose signature is already stored in the database" but notes its ineffectiveness against "zero-day attacks or new attacks." This academic source confirms the principle that signature-based systems (like those in an NGFW) target known threats

not zero-day attacks.

The question requires mapping core architectural characteristics to Ansible and Puppet.

• Model: Ansible operates on a push model by default. The central control node connects to managed nodes (typically via SSH) and "pushes" configurations or commands to them. Puppet uses a pull model, where an agent on each managed node periodically contacts a central "Puppet master" to "pull" its configuration catalog and apply any changes.
• Architecture: For high availability (HA), Ansible's enterprise solution (Automation Platform, formerly Tower) uses a primary/secondary architecture. It runs with a single active "primary" instance and one or more passive "secondary" instances that can be manually promoted. Puppet achieves HA and scaling through a multimaster architecture, where multiple active master nodes can serve agent requests, often with a load balancer in front.

Ansible (Push Model): Red Hat Ansible Documentation. (2024). Ansible architecture. "Ansible works by connecting to your nodes and pushing out scripts called 'Ansible modules' to them... Ansible then executes these modules (over SSH by default), and removes them when finished."

Source: docs.ansible.com/ansible/latest/dev_guide/overview_architecture.html (Section: Modules)

Ansible (Primary/Secondary): Red Hat Ansible Automation Platform Documentation. (2024). Automation controller high availability. "In this configuration, an automation controller cluster runs with a single active node, called the primary instance, and any number of inactive nodes, called secondary instances... This HA mode is not meant to run in an active/active or multi-master mode..."

Source: docs.redhat.com/en/documentation/ansible_automation_platform/2.4/html/ansible_automation_platform_installation_guide/aap_install_planning#ha-planning

Puppet (Pull Model): Puppet Documentation. (2024). Overview of Puppet's architecture. "In Puppet's agent/master architecture, a Puppet master server controls the configuration information, and a Puppet agent is installed on each managed node... The agent periodically polls the master for configuration updates... The agent fetches the catalog and applies it to the node."

Source: www.puppet.com/docs/puppet/8/architecture (Section: Agent/master architecture)

Puppet (Multimaster): Puppet Documentation. (2024). Scaling your Puppet Enterprise infrastructure. "For infrastructures with more than 4,000 nodes, we recommend a multi-master (or monolithic with compile masters) installation."

Source: www.puppet.com/docs/puppet_enterprise/2023.7/scaling_pe (Section: Choose an architecture)

Academic Comparison (Puppet): University of Helsinki. (2022). Course: DevOps with Docker - 4. Configuration management. "Puppet has a primary-secondary architecture. Agents (on secondary nodes) periodically send facts to the primary server (master) and pull a compiled configuration 'catalog'..."

Source: devopswithdocker.com/part-4-configuration-management (Section: Puppet)

REST APIs operate over the HTTP protocol. To protect the confidentiality of data exchanged, the communication must be encrypted. Transport Layer Security (TLS) is the standard cryptographic protocol that provides this security for HTTP, creating the secure HTTPS protocol. TLS encrypts the entire HTTP payload, including headers and body, preventing eavesdroppers from reading sensitive information such as authentication credentials, personal data, or proprietary information while it is in transit between the client and the server. This is the industry-standard mechanism for securing web and API communications.

B. 802.1X: This is an IEEE standard for port-based Network Access Control (PNAC), used to authenticate devices before granting access to a wired or wireless network. It does not encrypt application-layer data.

C. SSH: Secure Shell is a protocol primarily used for secure remote login, command-line execution, and tunneling. It is not the standard protocol for securing web-based REST API traffic.

D. IPsec: This is a network-layer (Layer 3) security protocol suite used to create secure tunnels (VPNs). While it can encrypt API traffic as part of overall network traffic, TLS is the specific and standard application-level mechanism for securing REST APIs.

1. Cisco Press: CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide. Chapter 27

"Network Programmability

" section "REST API Security Mechanisms." The text explicitly states that HTTPS (HTTP over TLS) is used to encrypt REST API messages to provide confidentiality.

2. Cisco DevNet: Introduction to APIs Learning Module. In the "REST APIs" section

under "API Security

" it is stated: "To keep your data safe

you should always use HTTPS when you make API requests." HTTPS is defined as HTTP secured by TLS.

3. IETF (Internet Engineering Task Force): RFC 8446 - The Transport Layer Security (TLS) Protocol Version 1.3. Section 1

"Introduction

" describes TLS as a protocol designed "to provide communications security" with confidentiality being one of its primary goals. This standard is the foundation for securing HTTP traffic.

The image requires matching descriptions of configuration management models to the correct paradigm: Procedural or Declarative. Procedural: A procedural model specifies a sequence of steps or commands that must be executed in a specific order to achieve a desired configuration. This is analogous to writing a script. "This model defines a set of commands that must be executed in a certain order for the system to achieve the desired state.": This is the definition of the procedural paradigm. The administrator outlines the exact sequence of operations. "Administrators require deep syntax and context knowledge for the configured entities.": Because procedural configuration involves writing explicit, ordered commands (like in a shell script or using a command-line interface), the administrator must have precise knowledge of the command syntax, flags, and the system's current state to ensure the script runs correctly. Declarative: A declarative model focuses on the desired final state of the system, the "what", rather than the specific steps required to get there the "how." The configuration management tool is responsible for determining the necessary actions to reach the declared state. "This model states what is wanted but not how it is achieved.": This is the core definition of the declarative approach. The administrator declares the target configuration, and the underlying system handles the implementation. "Puppet is a tool that uses this configuration model.": Puppet is a well- known configuration management tool that operates on a declarative model. Administrators write Puppet code to describe the desired state of resources, and the Puppet agent enforces that state.

1. Puppet Documentation: The official Puppet documentation states,

"Puppet is a declarative, model-based configuration management solution

that lets you define the state of your IT infrastructure, then automatically

enforces the desired state."

o Source: Puppet, Inc., "Overview of Puppet's architecture"

2. Cisco Documentation: In its discussion of modern network

programmability, Cisco differentiates between the older, procedural CLI-

based management and modern, declarative model-driven management. It

notes that declarative models specify the "what" (the desired outcome),

while imperative/procedural models specify the "how" (the exact

commands).

o Source: Cisco, "Cisco IOS XE Programmability Configuration

Guide, Release 16.10," Chapter: "Programmability, Automation, and

NETCONF/YANG Primer," Section: "Imperative versus Declarative."

3. IETF RFC 7223: This RFC, which describes a data model for interfaces,

implicitly supports a declarative approach. Data modeling languages like

YANG are used to create declarative models of network device

configurations, which contrasts with procedural CLI scripting.

o Source: IETF, RFC 7223, "A YANG Data Model for Interface

Management," Section 1.

This question tests knowledge of the specific function of each component within the Cisco security product portfolio.

• Cisco Umbrella is a cloud-native security service that provides the first line of defense by enforcing security at the DNS layer, blocking requests to malicious destinations before a connection is established.
• AMP4E (Cisco Secure Endpoint, formerly AMP for Endpoints) is an endpoint security solution that prevents, detects, and responds to malware on endpoints like workstations, laptops, and mobile devices.
• FTD (Cisco Firepower Threat Defense) is a unified next-generation firewall (NGFW) software image that integrates firewall functions with advanced threat protection, including IPS/IDS capabilities.
• StealthWatch (Cisco Secure Network Analytics) provides network-wide visibility and security analytics. It works by collecting and analyzing network telemetry data, such as NetFlow, to detect threats.
• ESA (Cisco Email Security Appliance) is a dedicated appliance (physical, virtual, or cloud) designed to protect against email-based threats like phishing, spam, and malware.

Cisco Umbrella: "Cisco Umbrella provides the first line of defense against threats on the internet wherever users go. By enforcing security at the DNS and IP layers, Umbrella blocks requests to malicious and unwanted destinations before a connection is even established..."

Source: Cisco, "Cisco Umbrella Data Sheet" (cisco.com)

Reference: "What is Cisco Umbrella" section, Paragraph 1.

AMP4E (Cisco Secure Endpoint): "Cisco Secure Endpoint (formerly AMP for Endpoints) integrates prevention, detection, threat hunting, and response capabilities in a single solution, leveraging the power of the cloud to protect endpoints."

Source: Cisco, "Cisco Secure Endpoint Data Sheet" (cisco.com)

Reference: "Product overview" section, Paragraph 1.

FTD (Firepower Threat Defense): "Cisco Firepower Threat Defense (FTD) is a unified software image... It integrates... Next-Generation Intrusion Prevention System (NGIPS) [and] Advanced Malware Protection (AMP)..."

Source: Cisco, "Cisco Firepower Threat Defense (FTD) Configuration Guide for Firepower Device Manager" (cisco.com)

Reference: "About Cisco Firepower Threat Defense" section.

StealthWatch (Cisco Secure Network Analytics): "Cisco Secure Network Analytics (formerly Stealthwatch) provides comprehensive network visibility and security analytics. It uses enterprise telemetry from your existing network infrastructure... It collects telemetry such as NetFlow, IPFIX, and other types of network flows..."

Source: Cisco, "Cisco Secure Network Analytics (Stealthwatch) Data Sheet" (cisco.com)

Reference: "Product overview" and "How it works" sections.

ESA (Cisco Email Security): "Cisco Email Security provides comprehensive protection against email-based threats. It is designed to detect, block, and remediate threats faster; prevent data loss; and secure important information in transit..."

Source: Cisco, "Cisco Email Security Data Sheet" (cisco.com)

Reference: "Product overview" section, Paragraph 1.

Protocol Independent Multicast - Sparse Mode (PIM-SM) is fundamentally designed for networks where receivers are sparsely distributed. Its core mechanism is a "pull model" (explicit join), meaning routers only receive multicast traffic after they explicitly send a Join message to request it. This contrasts with PIM Dense Mode's "push model" (flood-and-prune).

PIM-SM requires a central router known as a Rendezvous Point (RP) to act as a meeting point for sources and receivers. All traffic is initially sent toward the RP and then distributed down a shared distribution tree (also called an RP-Tree or RPT) to all interested receivers.

Internet Engineering Task Force (IETF) RFC 7761: Protocol Independent Multicast - Sparse Mode (PIM-SM): Protocol Specification (Revised)

Section 1 (Abstract): Explicitly states that PIM-SM "builds unidirectional shared trees rooted at a Rendezvous Point (RP) per group..."

Section 3.1 (Phase One: RP Tree): Describes the "pull" mechanism. It states, "...the DR [Designated Router] then sends a PIM Join message towards the RP for that multicast group." This confirms that traffic is explicitly requested (pulled) by receivers, not pushed from the source.

Cisco Systems, Inc. Documentation: IP Multicast Technology Overview

"PIM Sparse Mode" Section: This document contrasts the two modes, stating that PIM-SM "uses a pull model to deliver multicast traffic... PIM-SM assumes that no hosts want to receive multicast traffic unless they explicitly ask for it." It also confirms that "The shared tree is rooted at a router called the rendezvous point (RP)."

Juniper Networks Documentation: PIM Overview

"Sparse Mode" Section: This vendor documentation confirms the "pull" model: "In sparse mode, routing devices must join and leave multicast groups explicitly. Upstream routing devices do not forward multicast traffic... unless the downstream routing device has sent an explicit request (by means of a join message) to the rendezvous point (RP)..." It also states, "The RP serves as the root of the shared multicast delivery tree."

NetworkAcademy.IO (CCIE Courseware): PIM Basics - Versions, Neighbors, and States

"PIM Modes" Section: This educational source provides a clear distinction: "PIM Dense Mode - uses a push model to deliver multicast." and "PIM Sparse Mode - uses a pull model to deliver multicast."

An omnidirectional antenna is designed to radiate radio frequency (RF) energy uniformly in a 360-degree pattern in one plane (typically the horizontal plane). The dipole antenna is a classic and fundamental example of an omnidirectional antenna. Its radiation pattern resembles a doughnut, providing broad coverage in all horizontal directions from the antenna's central axis. This makes it suitable for scenarios requiring point-to-multipoint coverage where clients are distributed around a central access point.

A. Dish antennas are a type of highly directional antenna, designed to focus RF energy into a very narrow beam for long-distance, point-to-point communication.

B. High gain is a characteristic of directional antennas, which concentrate their power in a specific direction. Omnidirectional antennas have lower gain because they spread their energy over a wide area.

C. A focused and narrow beamwidth is the defining property of a directional antenna, which is the opposite of an omnidirectional antenna's wide, 360-degree horizontal beamwidth.

1. Cisco Aironet Antennas and Accessories Reference Guide: In the "Overview" chapter

under the section "Types of Antennas

" it states

"Omnidirectional antennas are designed to provide a 360-degree radiation pattern... The dipole antenna is an example of an omnidirectional antenna." It also classifies parabolic dish antennas as directional.

2. Enterprise Mobility 8.5 Design Guide - Cisco: In the chapter "Wireless LAN RF Design Considerations

" the section "Antenna Selection" describes the use of omnidirectional antennas for 360-degree coverage patterns and contrasts them with directional antennas

which are used to focus RF energy in a specific direction.

3. MIT OpenCourseWare

Course 6.02

Introduction to EECS II: Digital Communication Systems

Fall 2012: Lecture 18

"Wireless Communication

" describes the radiation pattern of a half-wave dipole antenna

illustrating its omnidirectional properties in the azimuth plane (the "doughnut" shape)

which is characteristic of this antenna type.

Cisco Catalyst SD-WAN establishes secure control plane connections between WAN Edge routers and the SD-WAN controllers (vSmart, vManage, vBond). These connections are encapsulated within Datagram Transport Layer Security (DTLS) tunnels by default, with an option to use Transport Layer Security (TLS). This ensures the authenticity, integrity, and confidentiality of all control plane communication, including the exchange of routing information, security keys, and policies via the Overlay Management Protocol (OMP), which runs inside these secure tunnels.

A. OMP: OMP is the control plane protocol used for routing and policy exchange; it is the protocol being protected by DTLS, not the protocol providing the protection.

B. STUN: STUN is a utility used for Network Address Translation (NAT) traversal, helping devices behind a NAT discover their public IP address, not for securing control traffic.

D. IPsec: IPsec is the protocol used to build secure tunnels for the data plane traffic between WAN Edge routers, not for the control plane connections to controllers.

1. Cisco SD-WAN Design Guide: In the "Cisco SD-WAN Security" chapter

the section "Control Plane Security" states

"Control connections are established using Datagram Transport Layer Security (DTLS) or Transport Layer Security (TLS) between the WAN Edge routers and the controllers... All control and management traffic exchanged between the controllers and the WAN Edge routers is encrypted."

2. Cisco Catalyst SD-WAN Overlay Network Design and Best Practices: In the "Control Plane" section

it is detailed that "The control plane is established by permanent DTLS/TLS tunnels between the WAN Edge routers and vSmart controllers

and between the WAN Edge routers and vManage."

3. Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide

Cisco IOS XE Catalyst SD-WAN Release 17.x: Under the "Control Connections" section

the guide specifies

"A Cisco Catalyst SD-WAN control plane connection is a DTLS tunnel that is established between a Cisco WAN Edge device and another Cisco WAN Edge device or a controller in the overlay network."

The Cisco Software-Defined Access (SD-Access) fabric data plane uses Virtual Extensible LAN (VXLAN) as its encapsulation technology. VXLAN encapsulates the original Layer 2 Ethernet frames from endpoints into UDP packets, which are then transported across the Layer 3 IP-based underlay network. This creates a virtualized overlay network, decoupling the endpoint's logical location from its physical location. The VXLAN header is also extended to carry Security Group Tags (SGTs) from Cisco TrustSec, enabling micro-segmentation and policy enforcement directly within the fabric data plane.

A. LISP: LISP (Locator/ID Separation Protocol) is the primary control plane protocol in the SD-Access fabric, responsible for mapping endpoint identifiers (EIDs) to their current network location (RLOCs).

B. IS-IS: IS-IS is a recommended Interior Gateway Protocol (IGP) used to build the underlay network, providing IP reachability between fabric nodes. It is not the data plane technology of the overlay fabric itself.

C. Cisco TrustSec: Cisco TrustSec is the policy plane technology. It provides identity-based access control and segmentation using Security Group Tags (SGTs), which are carried by the VXLAN data plane.

1. Cisco Systems

Inc. (2021). Cisco SD-Access Solution Design Guide (CVD).

In the "SD-Access Solution Components" section

under "Key Technologies

" it explicitly states: "Data Plane: The data plane is based on the Virtual Extensible LAN (VXLAN) encapsulation." It further clarifies

"Control Plane: The control plane is based on Locator/ID Separation Protocol (LISP)" and "Policy Plane: The policy plane is based on Cisco TrustSec

using Security Group Tags (SGTs)."

2. Cisco Systems

Inc. (2023). Cisco Digital Network Architecture Center (DNAC) User Guide

Release 2.3.5

Fabric Provisioning.

The section on "About Fabric" describes the architecture: "The SD-Access fabric is an overlay network that uses VXLAN as the data plane encapsulation and LISP as the control plane protocol to provide connectivity between devices."

3. Odom

W. (2020). CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide. Cisco Press.

Chapter 24

"Understanding Cisco SD-Access

" in the section "SD-Access Data Plane: VXLAN

" states: "The SD-Access data plane uses VXLAN... VXLAN encapsulates the original data frame sent by an endpoint device inside a new set of headers." (p. 738).

This configuration achieves the three goals:

1. Extend VRF: The vrf forwarding CORP command on the Tunnel0 interface assigns the tunnel to the CORP VRF.
2. Protect Tunnel: The tunnel protection ipsec profile CORP_IPSEC command applies the preconfigured IPsec profile to encrypt tunnel traffic.
3. Static Routing: The ip route vrf CORP ... Tunnel0 command installs a static route into the CORP VRF's routing table. This directs traffic destined for the remote site's LAN (e.g., 10.101.2.0/24 from R10) to use Tunnel0 as the exit interface, ensuring it is the only path used for this VRF traffic.

The tunnel source and destination commands use the global (non-VRF) IP addresses of the external interfaces for the underlying transport.

Cisco Systems, Inc. (2023). IP Routing: VRF-Lite Configuration Guide, Cisco IOS XE Amsterdam 17.3.x. "Information About VRF-Lite" and "How to Configure VRF-Lite" sections. (Documents the vrf forwarding command for interfaces).

Cisco Systems, Inc. (2024). Interface and Hardware Component Configuration Guide, Cisco IOS XE Cupertino 17.9.x. "Configuring Tunnels" chapter. (Details the tunnel source and tunnel destination commands for GRE).

Cisco Systems, Inc. (2023). Secure Connectivity Configuration Guide, Cisco IOS XE 17.x. "GRE and IPsec with VRF-Lite" section. (Covers the tunnel protection ipsec profile command and its use in VRF-aware tunnel scenarios).

Cisco Systems, Inc. (2024). IP Routing: BFD Configuration Guide, Cisco IOS XE 17. "Configuring Static Routing" chapter, "VRF-Aware Static Routes" section. (Provides syntax and examples for ip route vrf [vrf-name]).

Task 1 (R30): The goal is to modify the existing ACL nacl to permit EIGRP packets specifically from R10 (192.168.123.10) and R20 (192.168.123.20).

• ip access-list extended nacl enters the configuration mode for the named access list.
• 5 permit eigrp host 192.168.123.10 any inserts a rule (at sequence 5) to explicitly allow the EIGRP protocol (IP protocol 88) from R10's specific IP address.
• 10 permit eigrp host 192.168.123.20 any adds a second rule (at sequence 10) to allow EIGRP from R20's specific IP address. This configuration is precise and satisfies the requirement without overly permitting other traffic.

Task 2 (R20): This task requires configuring Control Plane Policing (CoPP) to rate-limit Telnet traffic from PC20.

1. An ACL (COPP_TELNET) is created to identify the specific traffic: TCP port 23 (Telnet) from the source host 192.168.24.124.
2. A class-map (COPP_TELNET_CLASS) is created to match the traffic defined in the COPP_TELNET ACL.
3. A policy-map (COPP_POLICY) is created. It uses the police command on the COPP_TELNET_CLASS to enforce a rate of 10,000 bps. The exceed-action drop command ensures any traffic beyond this rate is discarded, fulfilling the task requirements.
4. Finally, the service-policy command applies this policy to the control-plane in the input direction.

Cisco Systems. (2023). IP Access List Configuration Guide, Cisco IOS XE Bengaluru 17.6.x.

Section: "How to Configure IP Access Lists" -> "Configuring an IP Access List"

Details: This document outlines the use of the ip access-list extended command and the permit syntax. The permit eigrp command is shown as the correct method for filtering the EIGRP protocol. The host keyword is documented as the specific designator for a single IP address.

Cisco Systems. (2023). Control Plane Policing Configuration Guide, Cisco IOS XE 17.

Section: "How to Configure Control Plane Policing"

Details: This guide details the MQC (Modular QoS CLI) framework used for CoPP. It explicitly lists the required steps: 1) Create an ACL to identify traffic, 2) Create a class-map to match the ACL, 3) Create a policy-map to define actions (e.g., police), and 4) Apply the policy to the control plane using the service-policy command under the control-plane configuration mode.

Cisco Systems. (2023). QoS: Congestion Management Command Reference, Cisco IOS XE.

Section: "police (policy-map class)"

Details: This command reference specifies the syntax for the police command. The rate is specified in bits per second (bps), confirming that police 10000 correctly sets the limit to 10,000 bps. The exceed-action drop parameter is documented as the correct action to discard packets that violate the defined rate.

Cisco Software-Defined Access (SD-Access) architecture is built upon a distinct separation of control, data, and management planes. The data plane, which is responsible for encapsulating and forwarding user traffic across the fabric, utilizes Virtual Extensible LAN (VXLAN). Original Ethernet frames from endpoints are encapsulated within a VXLAN header and then a standard IP/UDP header for transport over the Layer 3 underlay network. This encapsulation creates a virtualized overlay network and allows for the transport of Layer 2 segments over a Layer 3 infrastructure. The VXLAN header is also extended to carry Scalable Group Tags (SGTs), which are fundamental to the group-based policy enforcement within the fabric.

A. Discovery and provisioning of access switches are management plane functions performed by Cisco DNA Center, often using Plug and Play (PnP), not by underlay dynamic routing protocols.

B. The control plane in an SD-Access fabric uses the Locator/ID Separation Protocol (LISP) to map and resolve endpoint-to-location (EID-to-RLOC) information, not VXLAN.

D. Similar to access switches, the discovery and provisioning of border switches are handled by the management plane (Cisco DNA Center), not directly by dynamic routing protocols.

1. Cisco Systems

"Cisco SD-Access Solution Design Guide (CVD)" (July 2023). In the "SD-Access Fabric" chapter

section "Planes of Operation

" it is explicitly stated: "The SD-Access solution data plane is based on the Virtual Extensible LAN (VXLAN) encapsulation... The SD-Access solution control plane is based on Locator/ID Separation Protocol (LISP)." (Reference: Chapter: SD-Access Fabric

Section: Planes of Operation).

2. Odom

W.

"CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide

" Cisco Press

2020. Chapter 25

"Understanding Cisco SD-Access

" under the section "SD-Access Data Plane

" states: "The data plane in the SD-Access fabric uses Virtual Extensible LAN (VXLAN) to create tunnels through the underlay." The section "SD-Access Control Plane" clarifies: "The control plane in the SD-Access fabric uses the Locator/ID Separation Protocol (LISP)..." (Reference: Chapter 25

pp. 768-770).

3. Cisco Systems

"Cisco SD-Access Fabric Resources

" White Paper (August 2022). This document details the architecture

stating

"The data plane uses VXLAN to provide transport virtualization

and the control plane uses LISP to provide endpoint reachability." (Reference: Section: "SD-Access Fabric Building Blocks

" subsection: "Control Plane and Data Plane").

Cisco Catalyst SD-WAN edge routers offer flexible deployment models to suit various branch and perimeter needs. They can be deployed as:

1. Hardware: Physical appliances such as the Cisco Catalyst 8000 Edge Platforms Family or Integrated Services Routers (ISRs).

2. Virtualized: Software instances, like the Cisco Catalyst 8000V Edge Software, running on-premises on standard hypervisors (e.g., VMware ESXi, KVM).

3. Cloud: Software instances deployed directly into public cloud environments (e.g., AWS, Microsoft Azure, Google Cloud Platform) to extend the SD-WAN fabric to cloud workloads.

A. This is incomplete. It omits the widely used hardware appliances and the specific cloud deployment model.

B. The term "software" is redundant and imprecise. Both virtualized and cloud instances are software-based; it is not a distinct deployment category in this context.

D. This is incomplete. It omits the significant and distinct use case of deploying virtual routers directly within public cloud infrastructure.

---

1. Cisco Systems

"Cisco SD-WAN Design Guide" (July 2022). In the "WAN Edge Platforms" chapter

the guide explicitly details the physical platforms (e.g.

Catalyst 8300 Series) and the virtual platform (Catalyst 8000V). The section on the Catalyst 8000V further specifies its deployment in both private data centers (on-premises virtualization) and public clouds (AWS

Azure

GCP).

2. Cisco Systems

"Cisco Catalyst 8000V Edge Software Data Sheet" (Updated: Feb 2024). The "Platform support" section clearly lists supported environments under two categories: "Hypervisor support" for on-premises virtualization and "Cloud support" for public cloud deployments

confirming these distinct forms.

3. Cisco Systems

"Cisco SD-WAN Getting Started Guide" (Updated: Dec 2023). In the "Cisco SD-WAN Components > WAN Edge Routers" section

the documentation states

"Cisco SD-WAN WAN Edge routers are available as hardware

software

cloud

or virtualized routers that sit at the perimeter of a site..." This directly supports the three forms: hardware

virtualized (on-prem)

and cloud.

The assignment of an IP address via DHCP follows a four-step process commonly known as DORA:

1. Discover: The client device, having no IP address, broadcasts a DHCP Discover message onto the network to find any available DHCP servers.
2. Offer: DHCP servers that receive the discover message respond to the client with a DHCP Offer message. This message contains a proposed IP address and other network configuration details.
3. Request: The client receives one or more offers and selects one. It then broadcasts a DHCP Request message that identifies the server and the IP address it wishes to accept.
4. Ack (Acknowledgment): The chosen DHCP server finalizes the lease and sends a unicast DHCP Ack message to the client, confirming that it can use the assigned IP address.

Internet Engineering Task Force (IETF). (1997). RFC 2131: Dynamic Host Configuration Protocol.

Location: Section 3.1, "Client-server interaction - allocating a new network address" (page 10).

Quote: This section explicitly outlines the sequence: "1. Client broadcasts a DHCPDISCOVER... 2. Server(s) send DHCPOFFER... 3. Client broadcasts a DHCPREQUEST... 4. Server sends DHCPACK..."

Microsoft Learn. (2023, September 21). DHCP Basics.

Location: Section: "DHCP lease process".

Synopsis: This official documentation describes the DORA (Discover, Offer, Request, Acknowledgment) process as the standard method for a DHCP client to obtain an IP address lease from a server.

MIT OpenCourseWare. (2018). 6.033 Computer System Engineering, Spring 2018.

Location: Lecture 15 Notes: Naming.

Synopsis: Section 15.3.3 details the DHCP protocol exchange, beginning with the client broadcasting a DHCP DISCOVER message, followed by a server's DHCP OFFER, the client's DHCP REQUEST, and finally the server's DHCP ACK.

Stateful Switchover (SSO) is a high-availability feature that provides redundancy by synchronizing critical state information (e.g., Layer 2 forwarding tables, configuration, access lists) between an active and a standby supervisor engine or route processor. In the event of an active processor failure, the standby processor takes over almost instantaneously. This rapid and stateful failover minimizes packet loss and network downtime, preventing routing protocol reconvergence. This capability to withstand a component failure with minimal service disruption is the core definition of network resiliency.

A. modularity: This refers to the physical design of a chassis that allows for adding or replacing components, which is distinct from the SSO software redundancy feature. C. flexibility: This describes a network's ability to adapt to different protocols, topologies, or policies, not its ability to recover from failures, which is SSO's primary function. D. scalability: This refers to a system's ability to handle growth in traffic, users, or services, whereas SSO is focused on fault tolerance, not performance expansion.

1. Cisco Systems, "Stateful Switchover (SSO) High Availability Configuration Guide, Cisco IOS XE Fuji 16.9.x". In the "Information About Stateful Switchover" section, the document states, "Stateful Switchover (SSO) provides RP redundancy... This feature dramatically improves the network resiliency and availability."

Source: Cisco IOS XE Software Configuration Documentation.

2. Cisco Systems, "High Availability Configuration Guide, Cisco Catalyst 9600 Series Switches, Cisco IOS XE Amsterdam 17.3.x". The "Stateful Switchover (SSO)" chapter describes the mechanism as a key component for high availability. The introduction states, "SSO provides a transparent switchover between the two supervisor engines, which makes the system resilient to a supervisor engine failure."

Source: Cisco Catalyst 9600 Series Switches Official Documentation.

3. Cisco Systems, "Campus LAN and Wireless LAN Design Guide". In the chapter "High Availability and Resiliency," Stateful Switchover (SSO) is detailed as a fundamental technology for achieving network resiliency. The guide explains, "SSO provides resiliency against hardware or software failures of a supervisor module within a single chassis."

Source: Cisco Validated Design (CVD) Program Documentation.

The Python script utilizes the json library to process a string. The variable data holds a string formatted as a JSON object. The function json.loads(data) parses this JSON string and converts it into a corresponding Python data structure. According to the standard JSON-to-Python conversion, a JSON object (enclosed in {}) is deserialized into a Python dictionary (dict). The final line, print(type(parseddata)), inspects the type of the resulting object and prints its class to the console, which will be . A dictionary is a data structure composed of key-value pairs.

B. list of lists: This would be the result of parsing a JSON string representing an array of arrays, such as '[ [1], [2] ]', not a JSON object.

C. list of strings: This would be the result of parsing a JSON array of strings, such as '["item1", "item2"]', not a JSON object.

D. tuple list: The standard json library in Python deserializes JSON arrays into Python lists (list), not tuples (tuple).

1. Python Software Foundation

Official Python Documentation: The json module documentation specifies the conversion from JSON to Python objects. The table shows that a JSON object is converted to a Python dict.

Source: Python 3.11.4 Documentation

json — JSON encoder and decoder

Section 19.2.2. Decoder and Deserialization. (https://docs.python.org/3/library/json.html#json-to-py-table)

2. Cisco Press

CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide: This guide covers data formats like JSON and their manipulation using Python for network automation. It explicitly states that JSON objects map to Python dictionaries.

Source: Rami

A.

Edgeworth

B.

Hucaby

D.

& Gooley

J. (2020). CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide. Cisco Press. Chapter 27

"Understanding and Using APIs

" Section "JavaScript Object Notation (JSON)."

3. Cisco DevNet

"Python for Network Engineers" Learning Track: Cisco's own developer resources emphasize the use of the json library for handling data from network device APIs

consistently showing the mapping of JSON objects to Python dictionaries.

Source: Cisco DevNet

"Intro to Python" Learning Lab

Module "Working with JSON

YAML

and XML". (https://developer.cisco.com/learning/lab/intro-python-part-2/step/5)

The Cisco Catalyst Center's southbound interface (SBI) is responsible for communication down to the network devices (switches, routers, etc.).

1. It supports multiple protocols to manage devices, including modern protocols like NETCONF and traditional protocols like SNMP and SSH/Telnet (covered by "others").
2. A key feature is its multivendor focus, enabling the management of both Cisco and third-party hardware.
3. This multivendor capability is achieved because the SBI is extendable by device packages (also called Device Packs). These packages contain the specific drivers, templates, and protocol definitions needed to manage a particular device model.

The "Intent API" and "uses JSON exclusively" are characteristics of the northbound API, which applications use to communicate with Catalyst Center.

Cisco Systems. (2024). Cisco Catalyst Center Third-Party Device Support.

Reference: This official documentation states that Cisco Catalyst Center (formerly DNA Center) "uses a device pack-based Software Development Kit (SDK) to extend its device and network support to third-party devices." This confirms the "multivendor focus" and that the platform is "extendable by device packages". It also notes that this support is enabled via protocols like SNMP and NETCONF, confirming the "supports..." option.

Cisco Systems. (2023). Cisco DNA Center Platform Overview.

Reference: Section: "Cisco DNA Center Platform APIs." This document clearly distinguishes the Northbound API (NBA) from the Southbound Interface (SBI). It explicitly identifies the NBA as the "Intent API," which is REST-based and uses JSON. This confirms that "referred to as Intent API" and "uses JSON exclusively" are characteristics of the northbound API, making them incorrect for this question.

H. J. L. van den Herik, et al. (2022). A Survey on Software-Defined Networking: Architecture, Orchestration, and Applications. Leiden University, LIACS.

Reference: Section 3.1 "SDN Architecture." Academic surveys on SDN (the architectural basis for Catalyst Center) define the Southbound Interface (SBI) as the communication channel between the controller and the network elements. This interface typically uses protocols like OpenFlow, NETCONF, SNMP, and PCEP. This reinforces that supporting these specific protocols is a defining feature of a controller's southbound interface. (DOI: 10.3390/app12073289)

Multicontext mode is a feature that partitions a single physical firewall into multiple virtual firewalls, known as security contexts. Each context operates as an independent device with its own security policies, interfaces (physical or logical), and administrative access. This architecture is specifically designed to provide logically separate and secure services for different departments, customers, or business units from a single hardware appliance, directly addressing the requirement in the question.

A. State sharing mode is a feature of high availability (HA) configurations, ensuring session continuity during a failover, not for segmenting services for different departments.

B. Layer 3 mode is a standard deployment method where the firewall routes traffic between interfaces. It does not inherently create separate virtual firewalls for departmental isolation.

D. Virtual switch mode, or transparent mode, allows a firewall to operate at Layer 2 like a "bump in the wire." This is a deployment model, not a feature for creating multiple virtual security instances.

1. Cisco

Cisco ASA Series CLI Book 1: General Operations

9.1

"Information About Security Contexts" chapter. The documentation states

"Security contexts partition a single ASA into multiple virtual devices

known as contexts. Each context is an independent device

with its own security policy

interfaces

and administrators... You might want to use multiple security contexts in the following situations: You are a service provider and you want to sell security services to many customers. By creating a context for each customer

you can implement their own security policy

and they can make changes to their own context without affecting other customers."

2. Cisco

Cisco Firepower 4100/9300 FXOS Firepower Chassis Manager Configuration Guide

2.2

"Multi-Instance Capability" section. For next-generation platforms

this feature is the evolution of multicontext mode. The guide explains

"The multi-instance capability allows you to run multiple instances of the Firepower Threat Defense software on the security appliance. Multi-instance is a multi-tenancy solution that is ideal for large enterprises and service providers."

3. Cisco

CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide

Chapter 25

"Securing the Network." The guide discusses firewall virtualization concepts

explaining that features like security contexts on the ASA allow a single device to be carved into multiple logical firewalls

which is a key method for implementing multi-tenancy and departmental segmentation.

The exec-timeout command is used in line configuration mode (line vty, line con, line aux) to set the idle timeout for an EXEC session. This command configures the device to automatically terminate a session if no user input is detected for the specified duration. Applying exec-timeout 120 to the VTY lines will cause any Telnet or SSH session that is idle for 120 minutes to be disconnected. This is a standard security practice to prevent unauthorized access to unattended, open sessions.

A. line vty 0 15 session-limit 120

This command limits the number of concurrent virtual sessions allowed on the VTY lines to 120, it does not control the duration of any single session.

C. line vty 0 15 absolute-timeout 120

This command sets a hard limit on the total connection time. It would terminate the session after 120 minutes, regardless of user activity, which is a different function than an idle timeout.

D. line vty 0 15 session-timeout 120

session-timeout is not a valid command for setting the EXEC session idle timer on a VTY line in Cisco IOS. The correct command is exec-timeout.

---

1. Cisco IOS Interface and Hardware Component Command Reference:

Command: exec-timeout

Description: "To set the interval that the EXEC command interpreter waits until user input is detected

use the exec-timeout line configuration command. ... The minutes argument specifies the time in minutes."

Source: Cisco

"Cisco IOS Interface and Hardware Component Command Reference

" Release 15M&T

Document ID: a006956. Section: exec-timeout.

2. Cisco IOS Interface and Hardware Component Command Reference:

Command: absolute-timeout

Description: "To set the time limit for a user to be connected to a specific line

use the absolute-timeout line configuration command. ... This command provides a way to enforce a time limit on a connection

regardless of whether the line is idle."

Source: Cisco

"Cisco IOS Interface and Hardware Component Command Reference

" Release 15M&T

Document ID: a006956. Section: absolute-timeout.

3. Cisco IOS Interface and Hardware Component Command Reference:

Command: session-limit

Description: "To limit the number of sessions on a line

use the session-limit line configuration command."

Source: Cisco

"Cisco IOS Interface and Hardware Component Command Reference

" Release 15M&T

Document ID: a006956. Section: session-limit.

Server virtualization enables the consolidation of multiple virtual machines (VMs) onto a single physical host. This consolidation is a primary benefit, as it significantly reduces the number of physical servers required, leading to a smaller data center footprint and lower power and cooling expenses. Another key advantage is operational agility. Deploying a new VM from a template or by cloning an existing one is a rapid process that takes minutes, compared to the hours or days required to procure, rack, install, and configure a new physical server. These efficiencies in resource utilization and deployment speed are foundational benefits of virtualization.

A. Virtualization often leads to larger, more complex Layer 2 domains to support VM mobility, rather than smaller ones.

C. While virtualization can enable advanced security models like micro-segmentation, it also introduces new security challenges (e.g., hypervisor vulnerabilities), so it is not an inherent or guaranteed benefit.

D. Virtualization increases the number of required IP and MAC addresses, as each VM needs its own unique network identity.

1. Wallace

K.

et al. (2020). Cisco ENCOR 350-401 Official Cert Guide

Volume 1. Cisco Press. In Chapter 2

"Virtualization

" the section "Server Virtualization" explicitly lists key benefits

including "Fewer servers to purchase and maintain" (supporting option E) and "Faster server provisioning" (supporting option B).

2. Cisco. (2012). IaaS: Increase Business Agility with a Virtualized Data Center. Cisco White Paper. Page 2

under "Benefits of a Virtualized Data Center

" states that virtualization helps "Reduce capital and operating costs by improving server utilization and reducing data center footprint

power

and cooling

" (supporting option E) and "Improve business agility and continuity by enabling faster server provisioning" (supporting option B).

3. Armbrust

M.

et al. (2009). Above the Clouds: A Berkeley View of Cloud Computing. University of California

Berkeley

EECS Department. Technical Report No. UCB/EECS-2009-28. Section 2.2

"Hardware Virtualization

" discusses how virtualization enables "elasticity and the transfer of capital expenses to operating expenses

" which is achieved through rapid provisioning (supporting option B) and hardware consolidation (supporting option E).

The Python script requires three parts to correctly serialize a Python dictionary into a JSON formatted string and print it. 1. import json: The first blank requires importing Python's built-in json module, which provides the necessary tools for working with JSON data. 2. json_string = json.dumps(data): The second blank uses the json.dumps() function to perform the conversion. This function takes a Python object (the data dictionary) and returns it as a JSON formatted string. This string is then assigned to the json_string variable. 3. print(json_string): The third blank prints the value of the json_string variable, which now holds the JSON representation of the original Python object.

Python Software Foundation. (2025). json — JSON encoder and

decoder. Python 3.13.3 documentation. This official documentation states,

"To use this module, import json" and describes the json.dumps() function

as the method to "serialize obj to a JSON formatted str".

o URL: https://docs.python.org/3/library/json.html#basic-usage

Guttag,

J. V. (2016). Lecture 10: Files. 6.0001 Introduction to Computer

Science and Programming in Python, Fall 2016. Massachusetts Institute of

Technology: MIT OpenCourseWare. The principles of handling different

data formats like JSON are covered in university-level computer science

introductions.

o URL: https://ocw.mit.edu/courses/6-0001-introduction-to-computerscience-and-programming-in-python-fall-2016/resources/lecture-10-

files/

Cisco Secure Network Analytics (formerly Stealthwatch) is a network visibility and security analytics solution. Its core function is to collect network telemetry, primarily NetFlow, from routers, switches, and other network devices. It uses this data to create a baseline of normal network behavior. By analyzing traffic patterns in real-time, it provides comprehensive awareness of all users, devices, and applications on the network. This visibility allows it to detect anomalies, policy violations, and potential threats, such as insider threats or advanced malware, that might otherwise go unnoticed.

A. Stealthwatch is primarily a detection and analytics tool. While it can identify traffic patterns indicative of a DDoS attack, dedicated DDoS mitigation solutions are responsible for actively stopping them.

B. Direct malware control (e.g., quarantining files, blocking execution) is the function of endpoint security solutions like Cisco Secure Endpoint, not a network traffic analysis platform like Stealthwatch.

D. Dynamic threat control specifically for web traffic is the primary role of a Secure Web Gateway (SWG), such as the Cisco Secure Web Appliance, which inspects and filters HTTP/S traffic.

1. Cisco. (2023). Cisco Secure Network Analytics (formerly Stealthwatch) Data Sheet. "Get real-time

end-to-end network visibility... Secure Network Analytics provides comprehensive visibility across the private network

public cloud

and even in encrypted traffic... See everything. Know who is on your network and what they are doing..." (Page 2

"Benefits" section).

2. Cisco. (2018). Cisco Stealthwatch: Visibility and security analytics for your digital business. White Paper. "Cisco Stealthwatch uses enterprise telemetry from every part of the network... to provide visibility across the extended network... It creates a baseline of normal network behavior and uses behavioral modeling and machine learning to identify and alert on anomalies." (Page 3

"How Stealthwatch works" section).

3. Cisco. (2020). Cisco Digital Network Architecture (DNA) Security Solution Overview. "Cisco Stealthwatch provides network visibility and security analytics to rapidly detect a wide range of attacks... It analyzes network telemetry to create a baseline of normal network behavior to detect anomalies." (Page 10

"Network visibility and segmentation" section).

The goal is to force traffic from PC-1 to the internet through CoreSW-2, then across the inter-switch link to CoreSW-1, and finally to router R1. This requires CoreSW-2 to be the Hot Standby Router Protocol (HSRP) active router for VLAN 10.

HSRP elects the active router based on the highest priority value (default is 100). If priorities are equal, the router with the highest IP address wins. By setting the priority of CoreSW-1 to 90, it becomes lower than CoreSW-2's default priority of 100. This configuration explicitly makes CoreSW-1 the standby router, ensuring CoreSW-2 becomes the active router and forwards the traffic as required by the question.

A. While setting CoreSW-2's priority to 110 also makes it the active router, option B is a more direct action to demote the router (CoreSW-1) that has the optimal path to the internet.

C. This configuration would make CoreSW-1 the active router because its priority (110) would be higher than CoreSW-2's default (100). Traffic would then bypass the inter-switch link, which is incorrect.

D. This command sets CoreSW-2's priority to its default value of 100. While CoreSW-2 would still become active via the IP address tie-breaker, this is a redundant command, not an explicit change to enforce the state.

1. Cisco IOS XE IP Routing: HSRP Configuration Guide

"HSRP Operation" section: "The router with the highest priority value becomes the active router. If there is a tie in the priority value

the router with the highest IP address of the HSRP interface becomes the active router. The priority value can be configured with the standby priority command. The default priority value is 100." This source confirms the election mechanism.

2. Wallace

K.

Edgeworth

B.

et al. (2020). CCNP and CCIE Enterprise Core ENCOR 350-401 Official Cert Guide. Cisco Press. Chapter 7

"First Hop Redundancy Protocols

" section "HSRP Configuration and Verification": This guide details the standby [group-number] priority command and confirms the default priority is 100. It explains that lowering a router's priority is a valid method to influence the active router election

making it the standby router.

Solution Steps Task 1: Configure R3 and R20 to not participate in the DR/BDR election in Area 20. To prevent a router from participating in the DR/BDR election on a specific interface, the OSPF priority on that interface must be set to 0. On Router R3: R3> enable R3# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R3(config)# interface e0/1 R3(config-if)# ip ospf priority 0 R3(config-if)# end On Router R20: R20> enable R20# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R20(config)# interface e0/0 R20(config-if)# ip ospf priority 0 R20(config-if)# end Task 2: Configure R10 to always be the DR for Area 10. To ensure a router always becomes the DR for a network segment (without changing router IDs), its OSPF interface priority must be set to a value higher than any other router on that segment. The highest possible priority value is 255. On Router R10: R10> enable R10# configure terminal Enter configuration commands, one per line. End with CNTL/Z. R10(config)# interface e0/0 R10(config-if)# ip ospf priority 255 R10(config-if)# end Explanation: The OSPF protocol elects a Designated Router (DR) and a Backup Designated Router (BDR) on multi-access networks (like Ethernet) to reduce routing updates and manage adjacencies efficiently. The election is decided based on the following criteria in order: 1. The router with the highest OSPF interface priority becomes the DR. The priority is an 8-bit unsigned integer from 0 to 255. 2. If priorities are equal, the router with the highest Router ID wins the election. Setting an interface's OSPF priority to 0 makes it ineligible to participate in the DR/BDR election process. For Task 1, applying ip ospf priority 0 to the Area 20 interfaces on R3 and R20 achieves the goal. For Task 2, to guarantee that R10 is always the DR for Area 10, its priority must be the highest on the segment. Setting the priority to the maximum value of 255 with the ip ospf priority 255 command ensures it will always win the DR election, as other routers default to a priority of 1 and the task prohibits changing router IDs.

Cisco Systems, IP Routing: OSPF Configuration Guide, "Configuring

OSPF" Chapter. This guide explains that the ip ospf priority interface

command is used to control a router's eligibility and likelihood of becoming

the DR. It confirms that a priority of 0 makes a router ineligible.

o URL: https://www.cisco.com/c/en/us/td/docs/iosxml/ios/iproute_ospf/configuration/15-sy/iro-15-sy-book/iro-cfg.html

o Section: "Configuring OSPF Interface Parameters" > "Controlling

DR/BDR Elections on an Interface"

•

IETF RFC 2328, OSPF Version 2, J. Moy, April 1998. This is the official

standard for OSPFv2.

o URL: https://datatracker.ietf.org/doc/html/rfc2328

o Section 9.4, "Electing the Designated Router": This section

explicitly states, "If a router's Router Priority is set to 0, it is ineligible

to become Designated Router." It also details the election algorithm

based on the highest priority, with the Router ID as a tie-breaker.

The script's goal is to print a specific value and then write a dictionary to a JSON file. 1. print: To display the device model on the screen, the built-in print() function is required. The expression data["devices"][0]["model"] correctly accesses the value "Cisco Nexus 3550". 2. open and w: To write to a file, it must first be opened. The open() function handles this. The second argument, the mode, must be "w" to open the file in write mode. The with statement ensures the file is properly closed afterward. 3. dump: The json module's dump() method is used to serialize a Python object (the data dictionary) and write it directly to a file-like object (the file handle created by open()).

1. Python Software Foundation. (2024). json — JSON encoder and

decoder. Python 3.12.3 documentation. "To use this module, start with

import json ... json.dump(x, f)" and "Serialize obj as a JSON formatted

stream to fp (a .write()-supporting file-like object)".

o URL: https://docs.python.org/3/library/json.html#basic-usage

2. Python Software Foundation. (2024). Built-in Functions: open(). Python

3.12.3 documentation. The documentation specifies 'w' as the character for

"open for writing, truncating the file first."

o URL: https://docs.python.org/3/library/functions.html#open

3. Guttag,

J. V. (2016). Introduction to Computation and Programming Using

Python, With Application to Understanding Data (2nd ed.). MIT Press.

Chapter 10 discusses file I/O, including the use of with open(...) for writing

to files.

o Reference: This is a standard textbook based on MIT's introductory

programming course (6.00.1x).