Free Cisco 350-401 Practice Exam with Questions & Answers

The correct answer is C. using BFD.

In Cisco Catalyst SD-WAN, the health of data plane tunnels is monitored using Bidirectional Forwarding Detection (BFD). Cisco documentation states that BFD runs over all data plane tunnels between Cisco IOS XE Catalyst SD-WAN devices and is used to monitor the liveness and path characteristics of those tunnels, including loss, jitter, and latency.

BFD is the protocol specifically used in Cisco SD-WAN to detect tunnel failures quickly and measure tunnel quality. These measurements are also used by SD-WAN features such as application-aware routing to make path-selection decisions.

A. with IP SLA IP SLA is a Cisco feature for measuring network performance in many environments, but Cisco SD-WAN data plane tunnel health is monitored with BFD, not IP SLA.

B. with OMP OMP (Overlay Management Protocol) is the control-plane routing protocol in Cisco SD-WAN. It distributes routes, TLOCs, and service information, but it does not monitor data plane tunnel health.

D. ARP probing ARP is used for Layer 2/neighbor resolution on local segments and is not the tunnel-health monitoring mechanism for SD-WAN data plane tunnels.

ENCOR exam point:

In Cisco Catalyst SD-WAN:

OMP = control-plane route exchange

BFD = data-plane tunnel liveliness and performance monitoring

The correct answer is A. It encapsulates IP packets from non-LISP sites with a LISP header.

In Cisco LISP, a PITR (Proxy Ingress Tunnel Router) provides connectivity between non-LISP sites and LISP sites. Cisco documentation states that a PITR performs ITR mapping database lookups and LISP encapsulation functions on behalf of non-LISP-capable sites. Cisco also explains that the PITR attracts traffic from non-LISP sites that is destined for LISP EID space, then encapsulates and forwards that traffic to LISP sites.

That is exactly what option A describes.

A PITR acts like an ingress tunnel router for non-LISP sources. When traffic comes from a non-LISP site toward a LISP destination, the PITR:

receives the traffic,

performs the mapping lookup,

adds the LISP header,

and forwards the encapsulated packet toward the correct LISP site.

B. It accepts registration requests and aggregates successfully registered EID prefixes to client ITRs. This describes the role of a Map Server (MS), not a PITR. Cisco states that the MS receives registrations from ETRs and advertises aggregates for registered EID prefixes into the mapping system.

C. It is responsible for publishing the site EID-to-RLOC mappings. This is also associated with the Map Server / mapping system, not the PITR. The PITR uses mappings for encapsulation; it does not publish them.

D. It forwards encapsulated messages to the MS to the authoritative ITR for the EID. This is incorrect terminology and mismatched function. Cisco explains that a Map Resolver (MR) accepts encapsulated Map-Request messages from ITRs and forwards them toward the appropriate Map Server or authoritative ETR, not an authoritative ITR.

ENCOR exam point:

Remember these LISP roles clearly:

ITR = encapsulates traffic toward LISP sites

ETR = decapsulates traffic arriving at LISP sites

PITR = performs ITR function for non-LISP to LISP traffic

MS/MR = mapping-system control-plane components

The correct answer is C. Data.

Cisco SD-WAN architecture is divided into three main planes:

Management Plane

Handled by vManage

Used for configuration and monitoring

Control Plane

Handled by vSmart (OMP protocol)

Responsible for routing information exchange and policy distribution

Data Plane

Built using IPsec tunnels between WAN Edge devices

Responsible for forwarding actual user/application traffic between sites

The data plane is the plane that:

Carries user traffic

Transports data between SD-WAN sites

Uses secure tunnels (IPsec) for communication

A. IPsec IPsec is a technology used within the data plane, not a plane itself.

B. Management Used for configuration and orchestration, not traffic forwarding.

D. Control Used for routing and policy decisions, not actual traffic transport.

Memorize SD-WAN planes:

Management Plane → vManage (configuration)

Control Plane → vSmart (routing/policy via OMP)

Data Plane → IPsec tunnels (user traffic transport)

User traffic = Data Plane

The correct answers are B. rpc statements and E. container statements.

YANG is a data modeling language used to model configuration and operational data for protocols such as NETCONF and RESTCONF. In YANG, the model is built using defined language statements such as container, list, leaf, and rpc. Cisco documentation explains that actions are defined in YANG models using RPC statements, and the YANG language definition identifies container as a standard statement used to define an interior data node in the schema tree.

Cisco documentation states that YANG models can define operational actions using RPC statements. These are used to trigger operations such as commands or actions on the device.

A container is one of the fundamental building blocks of a YANG model. It represents an interior node in the hierarchical data tree and is commonly used to group related configuration or state data.

A. HTTP return codes These belong to HTTP-based protocol behavior, not to the YANG model language itself.

C. JSON schema YANG is not a JSON schema language. Although YANG data may be encoded in JSON for some APIs, JSON schema is not a YANG model element. Cisco notes that protocols may use JSON formatting, but that does not make JSON schema part of YANG.

D. XML schema YANG is its own modeling language. NETCONF commonly uses XML encoding, but XML schema itself is not one of the YANG language statements.

ENCOR exam point:

Know the difference between:

YANG model elements → container, list, leaf, rpc

Data encodings / transport formats → XML, JSON

Protocol behaviors → HTTP status codes, NETCONF operations