ENCOR 350-401 (350-401) — Questions 1–75

VNFM manages individual VNFs; NFVO orchestrates network services; VIM controls NFVI resources.

DNA Center integrates with various systems for extended functionality. The correct answers cover REST API integration, syslog forwarding, and IPAM synchronization. The wrong answers incorrectly claim direct BGP peering for routing and that SNMP traps are the only northbound interface.

The correct order starts with importing the NAPALM library, then establishing a connection to the device, calling get_facts() to retrieve device facts, processing the returned dictionary, and finally closing the connection to free resources.

First create the SVI interface, assign an IP address, enable it, and then configure routing or ACLs as needed.

Hierarchical LAN design starts with the access layer for endpoint connectivity, then the distribution layer for policy and aggregation, followed by the core layer for high-speed transport. After physical design, VLANs and trunking are configured, and finally routing protocols are deployed for inter-VLAN communication.

VXLAN is the encapsulation protocol used in the Cisco SD-Access fabric to carry data plane traffic between fabric edge nodes. VXLAN provides a Layer 2 overlay over a Layer 3 underlay, enabling scalable segmentation and mobility without VLAN limitations.

DHCP snooping builds a binding table used by DAI. The switch validates DHCP messages, creates bindings, then intercepts ARP packets and compares them against the binding table to prevent spoofing.

Control messages manage the AP (e.g., configuration, keepalive); Data messages carry user traffic; Discovery messages find controllers; Join messages establish the AP-controller association; Configuration messages push settings to the AP.

The correct order begins with removing any existing SPAN session, then specifying the source interfaces or VLANs to monitor, then defining the destination interface for the analyzer, then optionally enabling encapsulation replication for trunk ports, and finally verifying the session is active.

dict stores key-value config pairs like interface settings, list stores ordered config lines, tuple stores immutable device credentials, set stores unique VLAN IDs, and frozenset stores immutable sets of allowed protocols.

VXLAN encapsulates Layer 2 frames in UDP packets over IP, allowing Layer 2 segments to be stretched across Layer 3 networks. This enables virtual machine mobility and multi-tenant environments without being constrained by physical network boundaries.

NETCONF/YANG is a valid method for automating network device configuration on Cisco IOS XE. NETCONF (RFC 6241) uses an XML-based RPC protocol to establish a secure SSH session (port 830) for configuration operations, while YANG (RFC 7950) provides a structured data model to define the configuration and state data. This combination allows for programmatic, transactional, and standardized configuration management, making it a core automation technology supported by Cisco.

The source-interface command ensures that all telemetry packets sent to the receiver use the IP address of Loopback0 as the source.

Graceful restart begins with the restarting router sending an OPEN message with the graceful restart capability, followed by the peer acknowledging, then the restarting router marking routes as stale, and finally the peer sending End-of-RIB markers.

This question tests detailed knowledge of DHCP snooping operation and configuration, including trusted/untrusted ports and option 82.

The output shows two NAT entries with the flag 'static' and a timeout of 'never'. Static NAT translations are manually configured and persist indefinitely in the translation table until explicitly removed by an administrator. This is why option D is correct.

WPA uses TKIP with PSK or 802.1X; WPA2 uses CCMP (AES) with PSK or 802.1X; WPA3 uses GCMP-256 with SAE or 802.1X; WPA2-Personal uses PSK; WPA3-Enterprise uses 802.1X with GCMP-256.

PAT translates private source IPs to a public IP with unique port numbers. The host sends a packet, the router creates a translation entry, replaces the source IP and port, forwards the packet, and reverses the process on the return.

Tail-drop drops all packets when queue is full; RED starts dropping packets probabilistically before queue full; WRED uses IP precedence or DSCP to vary drop probability per class.

Each component has a distinct role: Inventory defines managed nodes, Playbook is the execution blueprint, Role organizes content, Module is the execution unit, and Handler reacts to changes.

EF PHB (DSCP 46) is for low-loss, low-latency traffic; AF PHBs (AF1x-AF4x) provide assured forwarding with four classes and three drop precedences; CS PHBs (CS1-CS7) are backward-compatible with IP precedence; BE (DSCP 0) is best-effort; DF (DSCP 0) is the default PHB.

PPPoE session establishment begins with the Discovery stage: the client sends a PADI to find a server, the server responds with a PADO, the client selects a server and sends a PADR, the server assigns a session ID via PADS. Finally, the PPP link is negotiated using LCP and authentication.

GET retrieves; POST creates; PUT replaces; DELETE removes; PATCH partially updates.

The response is a dictionary with a key 'response' that contains a list. The list has one dictionary. To access 'overallHealth', you need to index the list and then the key.

Q-in-Q configuration requires first enabling the feature globally, then configuring the trunk port as a dot1q tunnel port, setting the native VLAN, and finally applying the service instance to encapsulate traffic. Verification ensures proper double-tagging.

802.1Q is an open standard that inserts a 4-byte tag, supports native VLAN, and is the default on modern switches. ISL is Cisco proprietary, encapsulates the entire frame, and does not support native VLAN.

Higher WEIGHT and LOCAL_PREF are preferred; lower MED, AS_PATH length, and IGP metric to next-hop are preferred.

The process starts with constructing the URI, then appending depth and field parameters, sending the GET request, the server filtering the response, and finally the client parsing the returned data.

Hello packets discover and maintain neighbor relationships; DBD packets contain a summary of the LSDB; LSR packets request specific LSAs; LSU packets send full LSAs in response to LSRs; LSAck packets acknowledge receipt of LSUs.

The script prints the site ID of the building if it exists. The output will be a string representing the UUID of the building.

Start-time defines when the operation begins; frequency sets the interval between probes; life sets the total duration of the operation.

class-map defines traffic classes; policy-map associates actions with classes; service-policy applies the policy to an interface or globally.

A virtual link connects a non-backbone area to Area 0 through a transit area. First, identify the ABR with the transit area, then configure the virtual link on both ABRs using the router ID of the neighbor, ensure the transit area has full OSPF adjacency, and finally verify the virtual link is operational.

In DMVPN Phase 3, when a spoke needs to send traffic to another spoke, it first sends data through the hub, the hub forwards the packet with a redirect, the spoke then sends an NHRP resolution request to the hub, the hub replies with the destination spoke's NBMA address, and finally the source spoke builds a direct mGRE tunnel to the destination spoke. The correct order is: spoke sends data through hub, hub sends redirect with NHRP trigger, spoke sends NHRP resolution request to hub, hub replies with destination spoke NBMA address, source spoke builds direct mGRE tunnel to destination spoke.

The correct order first defines the VRF, then configures the NAT inside and outside interfaces under the VRF, defines the NAT pool or ACL for translation, applies the NAT rule referencing the VRF, and finally verifies the translation with show ip nat translations vrf.

VRF-Lite uses only local VRFs without MPLS or MP-BGP, requiring trunk links; MPLS VPN uses MPLS labels and MP-BGP for scalable path isolation; VRF-Lite is simpler but limited to a single router or switch; MPLS VPN scales across an entire provider network; VRF-Lite does not support overlapping address spaces between sites without NAT.

The correct order for WRED configuration is: first define a class map matching TCP traffic (B), then create a policy map with the random-detect command (C), apply the service policy to an interface (D), and verify with show policy-map interface (E). Option A is a distractor; WRED is not enabled globally but per class under a policy map using the 'random-detect' command.

When a method list specifies RADIUS then local, the device first attempts RADIUS authentication. If the RADIUS server is unreachable (timeout), the device falls back to the next method in the list, which is local authentication using the local user database.

Standard VLAN ranges: Normal VLANs are 1-1005, but note that 1002-1005 are reserved for legacy Token Ring and FDDI. Extended VLANs are 1006-4094. Reserved VLANs are 0 and 4095.

To add a second receiver, you add another receiver line under the same subscription.

The correct order is: first enable SNMP agent globally (E), then define the community string (A), then configure an access-list for the manager (B), then create an SNMP view (C), and finally apply the view to the community (D). Enabling the agent globally must occur first to activate SNMP on the device, followed by defining community strings and associating them with ACLs and views for access control.

Cisco switches default to source MAC address-based load balancing for EtherChannel. This method distributes traffic based on the source MAC address of the frame, which can lead to uneven distribution if traffic patterns are not diverse.

CoPP evaluates packets by first classifying them into a class-map, then applying the policy-map to the control plane, which specifies the rate-limit action. The order ensures that classification happens before rate-limiting, and the final step is the action taken when the rate is exceeded.

A trunk port is specifically designed to carry traffic for multiple VLANs over a single physical link using IEEE 802.1Q encapsulation. This allows the switch to tag frames with VLAN IDs, enabling the router (often configured as a router-on-a-stick) to route between VLANs.

MPLS TE tunnel setup begins with IGP extension configuration to propagate link attributes, followed by explicit path definition. RSVP-TE then signals the tunnel using PATH messages, which are processed by intermediate routers to reserve bandwidth. Finally, RESV messages confirm the reservation and establish the tunnel.

RADIUS CoA allows a RADIUS server to dynamically change an active session's authorization. The server sends a CoA-Request to the network access device (NAD), which validates the request, applies the change, and responds with a CoA-ACK or CoA-NAK.

The Dijkstra algorithm first initializes the candidate list with the root node, then iteratively moves the lowest-cost candidate to the tree, updating neighbor costs, and finally builds the routing table from the shortest-path tree.