Cisco 350-401 - Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

Solution: -

A next-generation firewall protects against more than basic IP, port, and protocol violations. Its key value is application visibility and control. In a data center, an NGFW can identify applications regardless of port, inspect application behavior, enforce policy based on application identity, and block malicious or risky applications that traditional firewalls may allow if they use permitted ports such as TCP 80 or 443. Therefore, option D is the best answer. DDoS protection is usually handled by dedicated DDoS mitigation systems, upstream scrubbing services, rate limiting, or cloud-based DDoS protection rather than being the defining function of a data center NGFW. Unauthorized analyzers and rogue APs are not the primary threat categories addressed by a data center NGFW; rogue AP detection is more aligned with wireless security and WIPS/WIDS. The key ENCOR concept is that NGFWs add application awareness, user/context-based policy, intrusion prevention, malware inspection, and advanced threat defense to traditional stateful firewalling. References/topics: ENCOR Security, Cisco Threat Defense, next-generation firewall, application control, malware prevention, data center security.

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

The correct answer is A.

Block HTTP traffic (TCP port 80)

Source: 10.10.10.1

Destination: any

Permit all other traffic

ip access-list extended 100

deny tcp host 10.10.10.1 any eq 80

permit ip any any

deny tcp host 10.10.10.1 any eq 80 → Blocks HTTP traffic from 10.10.10.1 to any destination

permit ip any any → Allows all other traffic

This perfectly matches the requirement.

B. ip access-list extended 10 ❌ Invalid — extended ACLs use ranges 100–199 or named ACLs, not 10

C. ip access-list extended NO_HTTP ❌ Missing permit ip any any → implicit deny all at the end blocks everything

D. deny tcp host 10.10.10.1 eq 80 any ❌ Incorrect syntax/order

eq 80 is applied to destination port, not source

This line is malformed and does not match HTTP filtering correctly

ACL evaluation rules:

Top-down processing

First match wins

Implicit deny all at the end

Correct pattern for “block one thing, allow rest”:

deny < specific traffic >

permit ip any any