ENCOR 350-401 (350-401) — Questions 676–750

EBGP multihop allows the BGP session to be established between non-directly connected peers. The number specifies the maximum TTL for the BGP packets. Here, TTL=2 allows one intermediate hop.

Blocking discards frames and does not learn MACs; Listening discards frames but does not learn MACs (receives BPDUs); Learning discards frames but learns MACs; Forwarding forwards frames and learns MACs; Disabled administratively down and discards frames.

The correct order for SD-WAN traffic engineering app-aware routing steps is: first, traffic is classified by application (A); then path performance is measured via probes (B); then metrics are compared to SLA thresholds (C); then the best path meeting the SLA is selected (D); and finally traffic is forwarded over the chosen path (E).

First establish a NETCONF session, then subscribe to a YANG data stream, and finally receive periodic push updates.

LSR forwards packets based on labels, LER pushes/pops labels at the edge, P is a core LSR that only swaps labels, PE provides VPN services at the edge, and CE is the customer device connecting to the MPLS network.

On a broadcast multi-access network like Ethernet, OSPF defaults to a hello interval of 10 seconds. This is defined in RFC 2328 and is used to quickly detect neighbor failures while keeping control traffic overhead manageable. The corresponding dead interval is 40 seconds (4 times the hello interval).

In Cisco DNA Center, health scores range from 0 to 100. A score of 85 is considered 'good' (typically 75-90 range), indicating the device is healthy but may have minor issues.

Discovery uses Hello messages, Session uses Initialization/Keepalive, Advertisement uses Label Mapping, and Notification signals errors.

VNFs are software implementations of network functions; NFVI provides the infrastructure; MANO orchestrates and manages the lifecycle.

In DMVPN Phase 3, the spoke first registers its NHRP mapping with the hub, then the hub propagates the mapping. When a spoke needs to reach another spoke, it sends an NHRP resolution request to the hub, the hub replies with the mapping, and then the spoke initiates a direct IPsec tunnel to the target spoke.

PHP begins with egress LSR assigning implicit-null label (3) to FEC, advertising it upstream, penultimate LSR popping the label, forwarding the IP packet without label, and egress LSR performing IP lookup.

802.11r enables fast BSS transition (FT) with reduced reauthentication time; 802.11k provides neighbor report and channel information; 802.11v offers network-assisted power saving and BSS transition management.

The correct order begins with importing the base YANG module, then importing the augmentation module, resolving dependencies, applying augmentations to the base schema tree, and finally validating the combined schema.

That the YANG paths used in the subscriptions include leafs that change frequently, such as counters or timestamps, which trigger on-change updates even for minor changes. The other options are incorrect because the sample-interval is not used in on-change subscriptions; the collector load is not the cause; and the encoding format does not affect update frequency.

DAI validates ARP packets by first enabling it on VLANs, then using the DHCP snooping binding table as a source of truth. It checks the sender MAC and IP against the binding table and validates the packet format before forwarding or dropping.

App-route policies are applied to data traffic to influence path selection; cflowd policies enable flow monitoring; data policies control forwarding and NAT; control policies affect routing and TLOC advertisements; VPN membership policies control which VPNs are active on a device.

To use a hierarchical collector architecture with load balancers to distribute the telemetry streams. With 5000 devices, a single collector can become overwhelmed, so multiple collectors or a load-balanced cluster is essential. The other options are incorrect because using only periodic subscriptions does not address scalability; using a single YANG model is not practical; and using a single transport protocol is not feasible for a mixed environment.

The supplicant requests access, the authenticator (switch/AP) enforces port control, and the authentication server (RADIUS) validates credentials.

Supplicant requests access, Authenticator enforces port state, Authentication Server validates credentials.

TACACS+ command authorization starts with the user entering a command, which is sent to the TACACS+ server. The server checks the command against the user's authorization profile and responds with permit or deny. The device executes or blocks the command accordingly, and finally logs the result.

EIGRP supports a maximum hop count of 255. Unlike RIP, which has a limit of 15 hops, EIGRP can scale to larger networks. The hop count is used as one component in the composite metric, but it is rarely the limiting factor in practice.

ios_config pushes configuration commands, ios_command runs show commands, ios_facts gathers device facts, ios_vlans manages VLANs, and ios_l3_interfaces configures Layer 3 interfaces.

This is a standard NAT overload (PAT) configuration. The inside network 10.1.1.0/24 is translated to the IP address of the outside interface (GigabitEthernet0/2) with port multiplexing.

Named ACLs can be modified by inserting or deleting entries by sequence number. The correct order is: view current entries, delete the old entry, insert the new entry with a sequence number, verify, then save.

The correct order starts with defining the VRF, then configuring the inside and outside interfaces under the VRF, defining the NAT pool (if used), applying the access list for translation, and finally enabling NAT inside source with the VRF keyword.

Service chain instantiation begins with defining the chain, then selecting VNFs, allocating resources, connecting VNFs via virtual links, and finally testing the chain to verify functionality.

The issue is that PE2 has the prefix in its BGP VPNv4 table with a valid next-hop, but the route is not reachable from CE2. This indicates a label-switching problem in the MPLS core. The next step is to verify that LDP has allocated a label for the BGP next-hop address on PE2, because without an LDP label for the next-hop, the MPLS forwarding path is broken and packets cannot be label-switched across the provider core.

ESP provides confidentiality (encryption) and authentication; AH provides integrity and authentication but no encryption; ESP with NULL encryption provides authentication only.

The JSON response is nested. To access the IP address, you need to navigate through the dictionary: data['ietf-interfaces:interfaces']['interface'][0]['ipv4']['address'][0]['ip']. This returns '192.168.1.1'.

The output of 'show mpls ldp bindings' directly shows that for prefix 10.1.1.1/32, the local label assigned by R3 is 16, and the remote label learned from LSR 10.1.1.2 (its LDP peer) is 17. This is a straightforward reading of the command output, confirming the local and remote label bindings for that FEC.

PIM-SM uses a pull model where receivers join the shared tree via the RP, and the RP is the root of the shared tree. The SPT switchover occurs after the first packet arrives via the shared tree.

A 202 Accepted status code means the request has been accepted for processing, but the processing has not been completed. The discovery is asynchronous and will continue in the background.

IBNS 2.0 uses a policy map to define concurrent methods; the switch first tries 802.1X, then MAB as fallback, and if both fail, applies a critical or default ACL; the order is defined in the policy map class.

PortFast moves a port to forwarding immediately; BPDU Guard disables a port if a BPDU is received; Root Guard prevents a port from becoming a root port; Loop Guard prevents alternate/backup ports from becoming designated if BPDUs stop.

IKEv2 improves upon IKEv1 by using fewer messages for SA establishment and providing built-in NAT traversal and mobility support.

The route-map is applied to outbound updates to neighbor 10.0.0.2. It sets the BGP community value to 65001:100 on all routes advertised to that neighbor. The community is a well-known transitive attribute that can be used for routing policy.

MPLS Layer 3 VPNs use MP-BGP to exchange VPNv4 routes between PE routers, and each VRF maintains a separate routing table per customer. The P routers do not need to know customer routes, and the CE router does not run MPLS. The label stack includes both an IGP label and a VPN label.

IP SLA tracking uses only two standard object types: 'track ip sla <id> state' and 'track ip sla <id> reachability'. 'track ip sla <id> delay' and 'track ip sla <id> threshold' are not valid tracking objects. P1, P2, and P3 correctly map to their applications: reachability for floating static routes, state for adjusting HSRP priority, and reachability for policy-based routing. P4 and P5 are incorrect because the specified tracking objects do not exist.

PVLAN configuration requires first creating the primary VLAN, then the secondary VLANs (community or isolated), associating them, and finally configuring host ports as PVLAN ports. The order ensures proper VLAN hierarchy and port assignment.

HSRP uses priority to determine the active router. Preempt allows a higher-priority router to become active after a failure. Without preempt, the current active router remains active even if a higher-priority router comes online.

Desirable initiates negotiation, auto waits for partner.

Standard ACLs filter only source IP, extended ACLs filter more fields, and the implicit deny is always present. The incorrect options confuse the order of processing or the placement of ACLs.

Layer 3 EtherChannel setup requires creating port-channel interface, assigning IP, adding member ports with no switchport, configuring channel-group, and finally verifying routing.

The correct matches are: 802.11b with 2.4 GHz / 11 Mbps; 802.11g with 2.4 GHz / 54 Mbps; 802.11n with 2.4/5 GHz / 600 Mbps; 802.11ac with 5 GHz / 1.3 Gbps. Common confusions arise from mixing up data rates or frequency bands across generations.

MPLS provides predictable SLA and private connectivity; Broadband (Internet) offers low cost but variable quality; LTE/4G/5G provides wireless backup with lower bandwidth; Satellite offers high latency global coverage; Metro Ethernet provides high-speed metro-area connectivity.

Local mode serves clients with CAPWAP control and data; FlexConnect mode switches client data locally; Monitor mode listens for rogue APs; Sniffer mode captures packets for analysis; Rogue Detector mode detects rogue devices via wired network.

The correct matches are: show ip route displays the routing table, show ip interface brief summarizes interface status, ping tests connectivity, and traceroute traces the path. Common confusions arise from swapping the functions of show ip route and ping.

Hello packets discover and maintain neighbors; Update packets carry routing information; Query packets ask for alternate paths; Reply packets respond to queries; ACK packets acknowledge reliable delivery.

Each VDC in a Cisco Nexus switch can be configured with its own administrative credentials and a dedicated management interface (e.g., mgmt0). This allows separate administrative domains and management access per VDC, which is a key feature for multi-tenant environments.

DMVPN uses mGRE and NHRP; FlexVPN uses IKEv2; GET VPN uses GDOI; AnyConnect uses TLS/DTLS; Site-to-Site IPsec VPN uses IKEv1 or IKEv2 with ESP.

The access layer provides user connectivity; the distribution layer aggregates and applies policies; the core layer provides high-speed transport.

First, configure the police command with cir, pir, and conform, exceed, violate actions. Then, apply the policy to the interface. The marker uses CIR and PIR to assign colors.

The correct order starts with importing the Requests library, sending a POST request to the authentication endpoint with credentials, extracting the token from the JSON response, using the token in headers for a GET request to a resource endpoint, and finally parsing the JSON response.

TACACS+ uses TCP and encrypts the entire packet. It separates authentication, authorization, and accounting. The server sends a GETUSERNAME prompt first, then GETPASSWORD, and finally an ACCEPT or REJECT.

AS_PATH and NEXT_HOP are well-known mandatory; LOCAL_PREF is well-known discretionary; MED is optional non-transitive; COMMUNITY is optional transitive.

Site hierarchy creation begins with defining the top-level area (e.g., continent), then building down to building, floor, and finally assigning devices to the floor.

DMVPN has only three phases. Phase 1 uses NHRP for hub registration only; Phase 2 uses NHRP for spoke-to-spoke dynamic tunnel creation via resolution request/reply; Phase 3 uses NHRP with prefix-based spoke-to-spoke shortcut.

EtherChannel load balancing can use source/destination MAC, IP, or TCP/UDP port information. The default method varies by platform but is often src-dst-mac. The hash is computed per frame, and all frames in a flow use the same link to avoid reordering.

MPLS FRR begins with pre-configuring backup tunnel, protecting the primary LSP, detecting link/node failure via BFD or interface down, switching traffic to backup tunnel, and then signaling a new LSP for restoration.