350-401 Exam Dumps - Cisco CCNP Enterprise Questions and Answers

The correct answer is A.

Block HTTP traffic (TCP port 80)

Source: 10.10.10.1

Destination: any

Permit all other traffic

ip access-list extended 100

deny tcp host 10.10.10.1 any eq 80

permit ip any any

deny tcp host 10.10.10.1 any eq 80 → Blocks HTTP traffic from 10.10.10.1 to any destination

permit ip any any → Allows all other traffic

This perfectly matches the requirement.

B. ip access-list extended 10 ❌ Invalid — extended ACLs use ranges 100–199 or named ACLs, not 10

C. ip access-list extended NO_HTTP ❌ Missing permit ip any any → implicit deny all at the end blocks everything

D. deny tcp host 10.10.10.1 eq 80 any ❌ Incorrect syntax/order

eq 80 is applied to destination port, not source

This line is malformed and does not match HTTP filtering correctly

ACL evaluation rules:

Top-down processing

First match wins

Implicit deny all at the end

Correct pattern for “block one thing, allow rest”:

deny < specific traffic >

permit ip any any

The correct answer is A. The script retrieves device information by sending HTTP requests to the device ' s API endpoints.

The script uses the Python requests library:

response = requests . get( url )

This sends an HTTP GET request to:

http:// < device_ip > /api/device/info

This indicates communication with a REST API endpoint exposed by the network device.

Builds a URL using the device IP

Sends an HTTP GET request to the API

Checks if the response status code is 200 (OK)

If successful:

return response . json()

→ Converts the API response into a Python dictionary

Prints the retrieved device information

The script is clearly performing a read operation (GET)

It interacts with a REST API

It retrieves device information, not configuring anything

B. Configures device settings via secure connection ❌ No POST/PUT/PATCH methods are used ❌ No HTTPS or authentication shown

C. Establishes SSH connection ❌ No SSH libraries (like Paramiko or Netmiko) are used

D. Parses JSON into tabular structure ❌ It only returns and prints JSON ❌ No formatting (like pandas/table conversion) is performed

requests.get() → Retrieve data (READ)

requests.post() / put() → Modify or create data

.json() → Converts API response into Python dictionary

Key takeaway:

REST API + GET request = data retrieval from device

Solution:

Copy run start

Verification:

OR

The correct answers are B. Intrusion prevention and C. Application control.

Cisco documentation explains that a traditional firewall typically provides stateful inspection of traffic. A next-generation firewall (NGFW) adds advanced capabilities beyond that, including integrated intrusion prevention and application awareness/control.

Cisco describes Next-Generation Intrusion Prevention System (NGIPS) as a next-generation firewall capability that goes beyond what a standard stateful firewall provides. This allows the firewall to inspect traffic for malicious patterns and block threats, not just permit or deny sessions.

Cisco also lists Application Visibility and Control (AVC) or application awareness and control as a defining NGFW feature. This allows policies to be enforced based on the actual application, rather than only IP addresses, ports, and protocols.

A. Stateful traffic inspection This is a standard firewall capability, not a feature unique to NGFWs. Cisco specifically contrasts NGFW features with traditional stateful inspection.

D. Remote access VPN Cisco lists VPN as a firewall service, but it is not one of the advanced features that distinguish NGFW from a standard firewall. Cisco notes that NGFW capabilities are beyond traditional stateful inspection and VPN.

E. Network telemetry Network telemetry may be used for monitoring and analytics, but it is not identified by Cisco as one of the classic distinguishing NGFW features in this context.

ENCOR exam point:

Know this distinction clearly:

Standard firewall: mainly stateful inspection

Next-generation firewall: adds intrusion prevention and application control/visibility