Cisco 350-401 - Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) v1.2

The correct answer is A. aaa authorization exec default group radius if-authenticated.

The key part of this question is the phrase “when all the RADIUS servers are unreachable” and “if the user has successfully authenticated.” In Cisco AAA, the if-authenticated keyword means that if the authorization server cannot be reached, the device grants authorization as long as the user has already been authenticated successfully. Cisco documentation explicitly states that with:

aaa authorization exec default group radius if-authenticated

the device contacts the RADIUS server for EXEC authorization, and if an error occurs contacting the server, the fallback is to permit the CLI to start, provided the user has been properly authenticated.

The current config already has:

aaa authentication login default group radius local

So, if RADIUS is down, login can fall back to the local user database.

Adding:

aaa authorization exec default group radius if-authenticated

ensures that once the user is authenticated, authorization is permitted even if RADIUS is unreachable. This is the Cisco-supported fallback behavior for AAA authorization.

B. aaa authorization exec default group radius none The none method means no authorization is performed if the previous method fails, but this is not the Cisco ENCOR-recommended method for allowing access after successful authentication. The question specifically targets the if-authenticated authorization fallback behavior.

C. aaa authorization exec default group radius This attempts authorization through RADIUS only. If the RADIUS servers are unreachable, authorization fails and the administrator may not be able to proceed.

D. aaa authentication login default group radius local none This is an authentication command, not an authorization command, so it does not solve the requirement to authorize commands after login.

ENCOR exam point:

Remember the difference:

Authentication = verifies identity

Authorization = determines what the user is allowed to do

For Cisco AAA fallback behavior:

local is commonly used for authentication fallback

if-authenticated is the key keyword for authorization fallback when the AAA server is unreachable

The correct answer is B. TLS.

In Cisco Catalyst SD-WAN, the architecture separates:

Control Plane → Secure communication between controllers and edge devices

Data Plane → Encrypted tunnels carrying user traffic

The control plane (between vSmart, vBond, vManage, and WAN Edge routers) uses:

TLS (Transport Layer Security)

In some cases also DTLS, depending on configuration

These protocols provide:

Authentication

Encryption

Integrity protection

Thus, TLS is used to establish secure control plane adjacencies.

A. IPsec Used for data plane encryption (IPsec tunnels), not control plane.

C. IKE Used for key exchange in IPsec, not for SD-WAN control plane adjacencies.

D. ESP Part of IPsec (data plane encryption), not control plane.

Memorize this SD-WAN separation:

Control Plane → TLS / DTLS

Data Plane → IPsec (ESP encapsulation)

This distinction is frequently tested in ENCOR exams.

The correct command is login under line con 0. In classic Cisco IOS line authentication, setting a line password alone is not enough; the login command tells IOS to prompt for and validate the configured line password. The exhibit shows console line configuration with a password configured, and AAA is not enabled. Therefore, line con 0 followed by login enables console password checking using only the line password. Option A only disables console session timeout by setting the exec timeout to zero; it does not enable authentication. Option C, login local, tells IOS to authenticate against the local username database, which requires a username and password, not only the line password. Option D applies the setting to VTY lines, which control remote Telnet/SSH access, not the physical console line. This is a fundamental device-hardening and management-plane access-control concept. For ENCOR, candidates must distinguish line passwords, local username authentication, AAA authentication, console lines, and VTY lines. References/topics: ENCOR Infrastructure Security, console access, line password, login, login local, local authentication, device administration.

The correct answer is B. Template Editor.

Cisco Catalyst Center provides template-based automation to deploy configurations consistently across multiple devices.

The Template Editor is specifically used to:

Create reusable configuration templates

Use variables and parameters for different devices

Apply configurations to multiple devices with similar roles/settings

It supports Jinja2-based templates, enabling dynamic and scalable deployments.

This directly matches the requirement:

“build generic configurations that are able to be applied on devices with similar network settings”

A. Authentication Template This is not a primary Catalyst Center tool for building reusable configuration templates.

C. Application Policies Used for QoS and traffic policies, not for general configuration templating.

D. Command Runner Used to execute ad hoc CLI commands on devices, not to build reusable configurations.

Template Editor = Build reusable configs

Command Runner = Run one-time commands

Application Policies = Define traffic/QoS behavior

Automation in Catalyst Center = Template-based deployment

The Python library commonly used for NETCONF automation is ncclient. NETCONF is an XML-based network management protocol that uses YANG data models to structure configuration and operational state. The ncclient library provides Python functions for connecting to NETCONF-capable devices, opening a manager session, issuing get, get-config, edit-config, and other NETCONF operations, and processing XML responses. Option A is correct. The requests library is commonly used for REST API calls over HTTP or HTTPS, such as RESTCONF or controller northbound APIs, but it is not the standard NETCONF client library. Postman is an API testing application, not a Python library. cURL is a command-line tool for sending HTTP and other protocol requests, not a Python library for NETCONF/YANG workflows. In ENCOR automation, the distinction matters: REST-based APIs often use JSON and HTTP methods, while NETCONF uses XML-based RPC operations over SSH and is commonly automated in Python with ncclient. References/topics: ENCOR Automation, NETCONF, YANG, Python automation, ncclient, model-driven programmability.