350-401 Exam Dumps and Practice Questions

Cisco TrustSec separates access-control policy from traditional network topology by classifying users and devices into security groups and enforcing policy through Security Group Tags (SGTs). Instead of constructing policy primarily around VLAN numbers, physical locations, or large sets of source and destination IP addresses, TrustSec allows network authorization to be expressed according to the role or security group of the communicating endpoints. This makes option A correct.

Cisco describes TrustSec security-group access as transforming a topology-aware network into a role-based network. Packets can carry an SGT representing the source's security group, and intermediary switches, routers, or security devices use that identity information to enforce Security Group ACLs or equivalent policy.

TrustSec is not synonymous with a complete zero-trust framework, making B too broad. It also does not provide storage encryption, eliminating C. Option D describes link-layer encryption technology such as MACsec. TrustSec can be used in environments that also deploy MACsec, but TrustSec's defining purpose is identity- and group-based segmentation and policy enforcement rather than merely encrypting a wired link.

The protocol used by vManage to push centralized policies to vSmart controllers is NETCONF (Network Configuration Protocol). In Cisco SD-WAN:

• vManage uses NETCONF to configure and manage vSmart controllers and vEdge devices
• NETCONF provides secure, structured communication for configuration management using YANG data models
• Policies, templates, and configurations are encoded in XML and transmitted via NETCONF over SSH

This provides a standardized, secure method for centralized policy distribution and device management in the SD-WAN architecture.

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

The correct answers are B. rpc statements and E. container statements.

YANG is a data modeling language used to model configuration and operational data for protocols such as NETCONF and RESTCONF. In YANG, the model is built using defined language statements such as container, list, leaf, and rpc. Cisco documentation explains that actions are defined in YANG models using RPC statements, and the YANG language definition identifies container as a standard statement used to define an interior data node in the schema tree.

Why B is correct: rpc statements

Cisco documentation states that YANG models can define operational actions using RPC statements. These are used to trigger operations such as commands or actions on the device.

Why E is correct: container statements

A container is one of the fundamental building blocks of a YANG model. It represents an interior node in the hierarchical data tree and is commonly used to group related configuration or state data.

Why the other options are incorrect:

A . HTTP return codes

These belong to HTTP-based protocol behavior, not to the YANG model language itself.

C . JSON schema

YANG is not a JSON schema language. Although YANG data may be encoded in JSON for some APIs, JSON schema is not a YANG model element. Cisco notes that protocols may use JSON formatting, but that does not make JSON schema part of YANG.

D . XML schema

YANG is its own modeling language. NETCONF commonly uses XML encoding, but XML schema itself is not one of the YANG language statements.

ENCOR exam point:

Know the difference between:

YANG model elements container, list, leaf, rpc

Data encodings / transport formats XML, JSON

Protocol behaviors HTTP status codes, NETCONF operations

The script uses a NETCONF filter that targets the native Cisco IOS XE model and specifically filters the running configuration under interface -> GigabitEthernet -> name 1. The command shown in the script is m.get_config('running', interface_filter), followed by print(result). get_config is a read operation; it retrieves configuration data from the selected datastore, in this case the running datastore. It does not modify the device. Therefore, the result is printed XML output corresponding to the running configuration of GigabitEthernet 1 on the connected device. Option B is wrong because the script does not call edit_config, does not submit a configuration payload, and does not configure an IP address. Option C is wrong because NETCONF does not open an interactive CLI configuration mode. Option D is too broad and uses the wrong IP/network wording; the filter narrows the request to GigabitEthernet 1 rather than retrieving the full running configuration. This is a model-driven programmability question. Reference/topics: ENCOR Automation, NETCONF, YANG, ncclient, get_config, XML filters, Cisco IOS XE native model.