Cisco 350-401 - Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR)

The correct answer is D. It provides isolation among the virtual networks and independence from the physical network.

Cisco SD-Access is based on two main layers:

Underlay network → Physical infrastructure (routers, switches, IP connectivity)

Overlay network → Virtualized logical network built on top of the underlay

According to Cisco ENCOR architecture principles, the overlay network:

Uses technologies like LISP (control plane) and VXLAN (data plane)

Creates virtual networks (VNs) for segmentation

Provides end-to-end logical separation (macro-segmentation)

Is independent of the physical topology

Enables scalable and flexible network design

Thus, the overlay abstracts the complexity of the underlay and ensures isolation between different user groups, departments, or tenants.

Directly describes virtual network segmentation

Matches Cisco’s definition of overlay abstraction and independence

Core principle of SD-Access fabric design

A. Multicast and Layer 2 flooding relate more to underlay or legacy designs, not overlay behavior.

B. Describes the underlay network (physical devices), not overlay.

C. Refers to traditional network design, which SD-Access replaces.

Underlay = Physical IP network (reachability)

Overlay = Virtual segmentation & policy (VXLAN + LISP)

Overlay = Abstraction + Segmentation + Independence

The correct answer is C. no username and only the password " cisco123 " .

aaa authentication login group1 group radius line

This means:

Try RADIUS authentication first

If RADIUS fails/unreachable → fallback to line authentication

line con 0

password 0 cisco123

login authentication group1

Because RADIUS servers are not reachable, the router falls back to: → line authentication

When using line authentication, the router uses:

The configured line password

No username is required

Thus, login will prompt only for a password:

Password: cisco123

A. username " cisco " password " cisco " This uses the local user database, but local is NOT configured as fallback in group1.

B. password " test123 " This password is configured under VTY lines, not the console.

D. username " cisco " password " cisco123 " Combines local username with console password, but AAA fallback is to line, not local.

AAA authentication order matters:

group radius line → fallback is line password

group radius local → fallback is local username/password

Console + RADIUS down → uses line password only