ENCOR 350-401 (350-401) — Questions 751–825

The correct answers highlight key aspects of Python automation: Netmiko simplifies SSH management by handling authentication and connection, and NAPALM provides a vendor-agnostic API for retrieving operational data. The incorrect options misrepresent Python's role: Python does not compile to native machine code (it is interpreted), netmiko is not limited to Cisco (it supports many vendors), and paramiko is lower-level than Netmiko, not the other way around.

IGMPv1 has no leave message and uses a querier election based on IP address; IGMPv2 adds explicit leave and querier election using lowest IP; IGMPv3 adds source filtering (include/exclude) and supports SSM.

ERSPAN Type II (v1) uses a 6-byte GRE header with a 4-byte session ID; ERSPAN Type III (v2) uses an 8-byte GRE header with a 4-byte session ID and a 4-byte timestamp/index.

The correct order starts with defining the subscription parameters, then configuring the push method (periodic or on-change), followed by establishing the telemetry session, sending updates, and finally the collector processing the data.

Tunnel mode encrypts original IP header and adds new IP header; transport mode encrypts only payload; ESP tunnel adds ESP header between new and original IP; AH transport authenticates payload and original header; AH tunnel authenticates entire new packet.

Anycast Layer 2 gateway is the correct feature because it allows multiple fabric edge nodes to share the same anycast IP and MAC address for a given VLAN. If one edge node fails, endpoints simply continue using the same gateway address, and their traffic is automatically forwarded to a surviving edge node via the fabric's underlay routing, requiring no manual intervention or protocol convergence.

Policy creation starts with defining the policy in vManage GUI, then attaching it to a specific topology or group, committing the configuration, which triggers vManage to push the policy to vSmart, and finally vSmart distributes the policy to the edge devices.

Disable unused ports with 'interface range ... shutdown'; set login banner with 'banner login'; enable SSH with 'ip ssh version 2'; disable CDP with 'no cdp run'; set password encryption with 'service password-encryption'.

The process begins by subscribing to the OpenConfig path, receiving the encoded data, decoding it using the YANG model, extracting counters, and then analyzing the results.

SPAN on EtherChannel requires configuring the session, specifying source ports (member or port-channel), setting destination, and enabling.

Correct matches: Router forwards packets between networks, Switch forwards frames within a network, Firewall filters traffic. Common confusions include swapping these roles.

CoPP configuration requires defining class-maps first, then policy-map with police statements, then applying to control-plane. The order ensures proper traffic classification and rate-limiting.

The order reflects the default bridge network creation, container attachment, IP assignment, and then communication with the outside world via NAT.

The vSmart controller is the centralized control plane that distributes OMP routes and policies, while the vBond orchestrator handles authentication and NAT traversal. vManage is the management plane, not a control plane component. vEdge and cEdge are data plane devices. The OMP protocol runs between vSmart and edge devices, not between vManage and vSmart.

The output shows 'Prefixes: 3' under the neighbor details, which indicates that the neighbor has advertised exactly three prefixes to R1. This is a direct interpretation of the 'show ip eigrp neighbors detail' command, where the 'Prefixes' field lists the number of routes learned from that neighbor.

CPU pinning binds the vRouter's virtual CPUs to specific physical cores, preventing other processes from using them, while CPU reservation guarantees a minimum amount of CPU capacity. Together, they ensure deterministic CPU availability during traffic spikes, preventing packet drops due to resource contention on the KVM hypervisor.

Prepare establishes requirements; Plan identifies network needs; Design creates the detailed design; Implement deploys the design; Operate manages day-to-day; Optimize improves performance.

Micro-segmentation starts with classifying endpoints into SGTs based on identity, then defining SGT-to-SGT policies (permit/deny). The policies are enforced at the fabric edge, where the SGT is propagated in the VXLAN header, and traffic is filtered accordingly. Finally, monitoring ensures compliance.

noAuthNoPriv uses no authentication or encryption; authNoPriv uses authentication but no encryption; authPriv uses both.

Subscribe is used for streaming telemetry subscriptions, Capabilities retrieves supported RPCs, Get retrieves data, and Set modifies data.

SD-Access deployment begins with underlay configuration for physical connectivity, then overlay setup with LISP/VXLAN, followed by policy definition and integration with DNA Center for automation and assurance.

Named mode starts with the router eigrp <virtual-name> command, then enters address-family configuration, configures the network, and optionally adjusts timers or other parameters. Finally, the configuration is verified.

In Cisco SD-WAN, centralized control policies must be explicitly attached to a site list or VPN list to define which devices or traffic the policy applies to. If the policy is not attached to the appropriate list, the vSmart controller will not push the policy to the targeted vEdge routers, causing them to continue using the default OMP best-path selection (based on administrative distance and cost). The fact that the vEdge routers are connected to the vSmart confirms the issue is with policy application, not reachability.

LAN Automation begins with the seed device discovering new switches via CDP, then the new switches are automatically configured with the underlay template, including PnP and DHCP. After configuration, the switches join the fabric underlay, and finally, the automation process verifies connectivity and updates the inventory.

OSPF neighbors transition through Down, Init, 2-Way, ExStart, Exchange, Loading, and Full states. The correct order begins with the router sending Hello packets (Down to Init), then receiving a Hello reply (Init to 2-Way), electing DR/BDR if needed (2-Way to ExStart), exchanging database description packets (ExStart to Exchange), and finally synchronizing databases (Loading to Full).

A 204 No Content response indicates that the request was successful, but there is no content to return. In RESTCONF, a successful PATCH request that updates an existing resource typically returns 204 No Content. The engineer should verify that the route was applied by retrieving the configuration.

EIGRP uses a maximum hop count of 255 to prevent routing loops, though in practice it relies on its DUAL algorithm and feasible successor logic rather than hop count as a primary loop-prevention mechanism. This value is hard-coded in the protocol and cannot be changed, unlike RIP's 15-hop limit.

Sequence numbers allow editing named ACLs without re-entering all entries. The correct order is: view current entries, insert a new entry at a specific sequence, then verify the updated ACL.

The 'snmp-server group GRP v3 priv' command creates an SNMPv3 group with privacy (encryption) but does not associate it with any view. By default, SNMPv3 groups have no read, write, or notify access unless a view is explicitly configured. Without a view that permits read access to the MIB tree, the NMS cannot perform SNMP walks, even though the router responds to other queries (e.g., from different groups or versions).

FlexVPN is a Cisco implementation based on IKEv2, supporting hub-and-spoke, spoke-to-spoke, and remote access VPNs with centralized key management.

MAC flooding is mitigated by port security; DHCP starvation by DHCP snooping; ARP spoofing by DAI; STP manipulation by BPDU guard; VLAN hopping by disabling DTP.

network_cli uses SSH for CLI commands, netconf uses SSH for NETCONF XML, httpapi uses HTTP/HTTPS for REST APIs (e.g., NX-API).

Discovery starts with defining the discovery scope, running the discovery, adding discovered devices to inventory, syncing device details, and finally assigning devices to a site.

The command output shows 'Frequency (seconds): 60', which directly indicates that the IP SLA operation repeats every 60 seconds. This is the correct answer because the frequency parameter defines the time interval between successive probe executions.

The command 'passive-interface default' makes all interfaces passive by default, meaning they will not send or receive EIGRP hellos. The subsequent 'no passive-interface GigabitEthernet0/0' overrides this for that specific interface, allowing EIGRP adjacency formation on it.

Hello timer default is 5 seconds on LAN; Hold timer default is 15 seconds; Active timer default is 3 minutes.

SNMPv3 first discovers the engine ID, then the manager and agent agree on security parameters, authenticate, and finally encrypt the payload.

In MPLS Layer 3 VPNs, the PE router maintains separate VRF tables per customer and uses MP-BGP to exchange VPNv4 routes (including the route distinguisher and VPN label). The P router does not need to know customer routes; it only swaps labels. The CE router does not participate in MPLS; it runs standard IP routing with the PE.

The 'parentName' parameter specifies the name of the parent site (area or global) under which the building is created. This is necessary for building the site hierarchy.

Syslog sends a log message; SNMP trap sends an SNMP notification; trigger starts another IP SLA operation; none disables reaction; timeout triggers on probe timeout.

The RSPAN VLAN must be created, allowed on trunks, and then used in sessions to propagate traffic across switches.

EIGRP uses a maximum hop count of 255, which is a hard limit encoded in the protocol's metric field. This allows EIGRP to scale to much larger networks than distance-vector protocols like RIP, which have a hop count limit of 15. The hop count is not used as a primary metric in EIGRP but serves as a loop-prevention mechanism, and routes with a hop count exceeding 255 are considered unreachable.

In the DiffServ QoS pipeline, traffic must first be classified using class maps, then marked with a policy map, and finally applied to an interface using a service policy. The order ensures that packets are identified, marked, and then enforced on the egress interface.

VLANs 1–1005 are normal range, 1006–4094 extended, 0 and 4095 reserved, 1002–1005 are default token ring/FDDI VLANs, and 1 is the default Ethernet VLAN.

Telemetry can be collected via SNMP (pull), Syslog (push), and model-driven telemetry (push). SNMP polling is a classic pull method, while Syslog and MDT are push-based. MDT offers higher scale and flexibility compared to SNMP.

Auto-RP uses a mapping agent that listens for RP announcements, then advertises the RP mapping via a well-known group; all routers learn the RP and use it for group-to-RP mapping.

The correct order follows the ETSI NFV lifecycle: first onboard the VNF package, then instantiate the VNF, configure the VNF, scale the VNF as needed, and finally terminate the VNF when no longer required.

Cisco ISE evaluates RADIUS policies in a specific order: first it checks authentication policies, then authorization policies (including exception policies), and finally applies the matched authorization profile. If no match, the default deny policy applies.

gRPC uses HTTP/2, gNMI uses gRPC, NETCONF uses SSH, RESTCONF uses HTTPS, and HTTP is not a standard telemetry transport.

The control plane handles routing and signaling; the data plane forwards packets; the management plane provides GUI/API access; the orchestration plane automates device onboarding and certificate management.

Periodic sends data at fixed intervals, on-change sends data when a value changes, and target-defined uses the device's own update policy.

gRPC uses HTTP/2, gNMI uses gRPC (HTTP/2), NETCONF uses SSH, and RESTCONF uses HTTPS.

The correct order starts with the local PE learning the customer route via IGP or static, then redistributing it into MP-BGP with a route distinguisher, advertising the VPNv4 route to the remote PE, which receives and installs it into the VRF, and finally the remote PE redistributes the route into the customer-facing IGP.