Pass the Cisco CCNP Enterprise 350-401 Questions and answers with CertsForce

The status code shown in the exhibit is HTTP 403, which means the server understood the request but refused to authorize it. This is different from a missing resource, unreachable server, or state conflict. Option D is correct because a 403 Forbidden response indicates that access was denied due to authorization, permission, policy, or authentication-context restrictions. Option A describes a 410 Gone condition, where the resource is no longer available. Option B is not represented by a 403; unreachable resources normally produce network errors, timeouts, DNS issues, or gateway-level errors. Option C aligns more closely with HTTP 409 Conflict, which indicates the request conflicts with the current state of the resource. In API troubleshooting, reading the response code accurately matters. 401 usually means authentication is required or failed, while 403 means the client is recognized or the request is understood, but access is not allowed. The ENCOR automation focus is interpreting REST API status codes correctly during controller, network assurance, and programmability workflows. References/topics: ENCOR Automation, REST APIs, HTTP response codes, API authorization, 403 Forbidden, controller API troubleshooting.

The correct answer is D.

To meet the requirement, the configuration must do two things:

Permit only the 10.10.10.0/24 subnet to access the VTY lines

Allow only a secure remote access protocol, which is SSH

The correct Cisco IOS configuration is:

access-list 23 permit 10.10.10.0 0.0.0.255

line vty 0 15

access-class 23 in

transport input ssh

access-list 23 permit 10.10.10.0 0.0.0.255 This correctly matches the subnet 10.10.10.0/24 using the proper wildcard mask 0.0.0.255.

line vty 0 15 This applies the restriction to all VTY lines, not only a subset.

access-class 23 in This filters incoming remote access connections to the router.

transport input ssh This allows only SSH, which is encrypted and secure, and prevents Telnet or other clear-text remote access protocols.

A is incorrect because:

access-class 23 out filters outbound connections from the VTY lines, not inbound management access.

transport input all allows insecure protocols such as Telnet.

B is incorrect because:

255.255.255.0 is a subnet mask, not a wildcard mask, so the ACL syntax is wrong for a standard ACL entry.

C is incorrect because:

It applies only to VTY 0 4, while the router also has VTY 5 15 configured.

This leaves other VTY lines unrestricted, which does not fully meet the requirement.

For secure remote management on Cisco devices:

Use transport input ssh to disable Telnet

Use access-class < ACL > in on VTY lines to restrict who can connect

Use the correct wildcard mask for the subnet

For 10.10.10.0/24, the wildcard mask is:

0.0.0.255

So the complete secure solution is:

restrict inbound VTY access + allow only SSH + apply to all VTY lines

top down - while true, file.open(), except, file = open, file.close()

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

R10

Copy run start

R20

Copy run start

Verification: