Cisco 350-401 - Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) v1.2

Without AAA, the router can still use the local username database for authentication. To place a user directly into privileged EXEC mode after successful login, the local username can be created with privilege level 15, for example username admin privilege 15 secret < password > , and the console line can use local login. This causes the user to receive privilege level 15 after authentication rather than starting in user EXEC mode and then entering the enable password. Option D is therefore the best answer because it ties the privilege level to the authenticated local user. Option A is wrong because it explicitly uses RADIUS or TACACS+, which contradicts the requirement to avoid AAA. Option B is not valid IOS syntax for achieving this behavior. Option C can set the privilege level for a console line, but it is line-based rather than credential-based and does not specifically satisfy the requirement that the privilege be granted after the user provides the correct login credentials. The ENCOR security concept is local device administration without centralized AAA. References/topics: ENCOR Infrastructure Security, local authentication, console access, privilege levels, username privilege 15, device management.

The correct answer is B. Router A.

VRRP elects the Master (primary virtual router) based on:

Highest priority (default = 100)

If priorities are equal → highest IP address wins

Router A

IP: 192.168.0.100

Priority: default (100)

Router B

IP: 192.168.0.2

Priority: default (100)

Router C

IP: 192.168.0.3

Priority: 80

Router D

IP: 192.168.0.4

Priority: 70

Compare priorities:

A = 100

B = 100

C = 80

D = 70

→ Highest priority = 100 (A and B tie)

Tie-breaker → Highest IP address:

Router A = 192.168.0.100

Router B = 192.168.0.2

→ 192.168.0.100 is higher

Router A becomes the VRRP Master (primary virtual router).

Router B Same priority as A but lower IP address

Router C Lower priority (80)

Router D Lowest priority (70)

VRRP Election Rule:

Highest Priority → Highest IP (tie-breaker)

Default priority = 100, so always check:

Who changed priority?

If equal → compare interface IPs

A next-generation firewall protects against more than basic IP, port, and protocol violations. Its key value is application visibility and control. In a data center, an NGFW can identify applications regardless of port, inspect application behavior, enforce policy based on application identity, and block malicious or risky applications that traditional firewalls may allow if they use permitted ports such as TCP 80 or 443. Therefore, option D is the best answer. DDoS protection is usually handled by dedicated DDoS mitigation systems, upstream scrubbing services, rate limiting, or cloud-based DDoS protection rather than being the defining function of a data center NGFW. Unauthorized analyzers and rogue APs are not the primary threat categories addressed by a data center NGFW; rogue AP detection is more aligned with wireless security and WIPS/WIDS. The key ENCOR concept is that NGFWs add application awareness, user/context-based policy, intrusion prevention, malware inspection, and advanced threat defense to traditional stateful firewalling. References/topics: ENCOR Security, Cisco Threat Defense, next-generation firewall, application control, malware prevention, data center security.

The correct answer is B. Only the database can initiate communication.

From the exhibit:

ip nat inside source static 10.1.2.100 interface GigabitEthernet0/1

Inside local (DB): 10.1.2.100

Inside global (translated IP): 10.50.250.1 (Gi0/1 interface)

NAT type: Static NAT

Static NAT creates a permanent one-to-one mapping between inside local and inside global IP.

It allows bidirectional communication, but only if traffic is properly addressed.

The server initiates the connection

The server expects the DB to appear as 10.50.250.0/24 (translated network)

The server sends traffic to 10.50.250.1 (inside global IP).

The router translates:

Destination → 10.1.2.100 (DB) ✔️

DB receives the request and responds.

Return traffic is translated back to 10.50.250.1 ✔️

However:

The NAT rule only defines source translation for traffic originating from inside (DB).

It does not fully support proper session handling when initiated from outside unless routing/NAT symmetry is correct.

In this topology, the expectation and flow mismatch causes only inside-initiated sessions to work reliably.

The database (inside) can initiate connections outward using NAT ✔️

The server (outside) initiating may fail due to NAT direction and expectation mismatch ❌

A. Only the server can initiate communication Incorrect — NAT favors inside-initiated traffic.

C. No communication possible Incorrect — inside-initiated traffic still works.

D. Both can initiate communication Incorrect — would only be true with correct bidirectional NAT design.

Static NAT = bidirectional mapping, BUT

Always check:

Who initiates traffic

Which side is inside vs outside

Whether NAT rules match expected traffic flow

Exam trick:

If NAT is configured as inside source , it primarily supports inside → outside initiation.