Free Cisco 350-401 Practice Exam with Questions & Answers | Set: 7

The correct answer is A. It encapsulates IP packets from non-LISP sites with a LISP header.

In Cisco LISP, a PITR (Proxy Ingress Tunnel Router) provides connectivity between non-LISP sites and LISP sites. Cisco documentation states that a PITR performs ITR mapping database lookups and LISP encapsulation functions on behalf of non-LISP-capable sites. Cisco also explains that the PITR attracts traffic from non-LISP sites that is destined for LISP EID space, then encapsulates and forwards that traffic to LISP sites.

That is exactly what option A describes.

A PITR acts like an ingress tunnel router for non-LISP sources. When traffic comes from a non-LISP site toward a LISP destination, the PITR:

receives the traffic,

performs the mapping lookup,

adds the LISP header,

and forwards the encapsulated packet toward the correct LISP site.

B. It accepts registration requests and aggregates successfully registered EID prefixes to client ITRs. This describes the role of a Map Server (MS), not a PITR. Cisco states that the MS receives registrations from ETRs and advertises aggregates for registered EID prefixes into the mapping system.

C. It is responsible for publishing the site EID-to-RLOC mappings. This is also associated with the Map Server / mapping system, not the PITR. The PITR uses mappings for encapsulation; it does not publish them.

D. It forwards encapsulated messages to the MS to the authoritative ITR for the EID. This is incorrect terminology and mismatched function. Cisco explains that a Map Resolver (MR) accepts encapsulated Map-Request messages from ITRs and forwards them toward the appropriate Map Server or authoritative ETR, not an authoritative ITR.

ENCOR exam point:

Remember these LISP roles clearly:

ITR = encapsulates traffic toward LISP sites

ETR = decapsulates traffic arriving at LISP sites

PITR = performs ITR function for non-LISP to LISP traffic

MS/MR = mapping-system control-plane components

The correct answer is A. by providing the external application a token that authorizes access to the account.

In REST APIs, OAuth is used as an authorization framework. Instead of giving the external application the user’s actual username and password, the user or authorization server provides the application with an access token. That token allows the application to access specific resources based on the permissions granted.

This is the main purpose of OAuth:

Authorize access

Use tokens instead of exposing credentials

Allow controlled, limited access to resources

B. as a framework to hide the security information in the REST URL OAuth does not work by hiding information in the URL. It is an authorization framework based on tokens.

C. as a framework to hash the security information in the REST URL OAuth is not a URL-hashing mechanism. Hashing and OAuth are different concepts.

D. by providing the user credentials to the external application This is the opposite of OAuth’s purpose. OAuth is designed so that the external application does not need the user’s credentials.

Remember this difference:

Basic Authentication → sends username/password

OAuth → uses token-based authorization

OAuth = token-based delegated access

The correct answer is B. TLS.

In Cisco Catalyst SD-WAN, the architecture separates:

Control Plane → Secure communication between controllers and edge devices

Data Plane → Encrypted tunnels carrying user traffic

The control plane (between vSmart, vBond, vManage, and WAN Edge routers) uses:

TLS (Transport Layer Security)

In some cases also DTLS, depending on configuration

These protocols provide:

Authentication

Encryption

Integrity protection

Thus, TLS is used to establish secure control plane adjacencies.

A. IPsec Used for data plane encryption (IPsec tunnels), not control plane.

C. IKE Used for key exchange in IPsec, not for SD-WAN control plane adjacencies.

D. ESP Part of IPsec (data plane encryption), not control plane.

Memorize this SD-WAN separation:

Control Plane → TLS / DTLS

Data Plane → IPsec (ESP encapsulation)

This distinction is frequently tested in ENCOR exams.