ENCOR 350-401 (350-401) — Questions 901–975

PIM Sparse Mode uses explicit join to build a shared tree; Dense Mode floods initially then prunes; Source-Specific Mode uses shortest path trees from source; Bidirectional PIM uses a shared tree with no source-specific state.

Pinning vCPUs to dedicated physical cores and allocating memory from the same NUMA node eliminates cross-NUMA memory access and CPU scheduling contention, which are critical for reducing latency and maximizing throughput in a data-plane-intensive VNF like the CSR1000v. This ensures that the VM's memory accesses are local to the NUMA node where its vCPUs run, avoiding the performance penalty of remote memory access over the QPI/UPI interconnect.

The order starts with configuring the export RT on the VRF, the PE advertising the VPNv4 route with that RT, the remote PE receiving the route and comparing the RT with its import RT list, if matched the route is imported into the VRF, and finally the route is installed in the VRF routing table.

The correct order for configuring traffic shaping or policing is: first, define a class map to match the desired traffic (A); second, create a policy map that specifies the shape or police action (B); third, apply the service policy to the interface (C); fourth, verify the policy using the show policy-map interface command (D); and finally, adjust the shaping rate or policing burst as needed based on verification results (E). This sequence ensures that traffic classification and policy definition are completed before applying the policy, and verification is done before making adjustments.

SGT propagation via SXP starts with ISE assigning an SGT to an endpoint, the access switch mapping IP-to-SGT, then the SXP speaker sending that mapping to an SXP listener, which updates its local SGT cache, and finally the listener uses the SGT for policy enforcement.

On broadcast multi-access networks like Ethernet, OSPF defaults to a hello interval of 10 seconds. This is defined in RFC 2328 and is used to quickly detect neighbor failures while keeping overhead low. The corresponding dead interval is 40 seconds (4 times the hello interval).

The configuration uses LACP with one side in active mode (GigabitEthernet0/1) and the other in passive mode (GigabitEthernet0/2). LACP allows an active/passive combination to form an EtherChannel, unlike PAgP which requires at least one side to be in desirable mode. The trunk and allowed VLANs are configured on the port-channel interface, which applies to all member ports once the channel is established.

ISE profiling identifies the device type via DHCP/HTTP probes, matches it to a profile, then ISE downloads a dynamic ACL to the switch, which applies it to the port, and finally the switch enforces the ACL on traffic from that endpoint.

The correct order starts with defining the discovery range (IP/subnet), then running the discovery, then the discovered devices are added to inventory, then DNA Center syncs the device configurations, and finally the devices are assigned to sites. This ensures devices are properly discovered, inventoried, and placed in the hierarchy.

The 'rx' keyword monitors only received traffic; 'tx' monitors only transmitted traffic; 'both' monitors both directions; 'ingress' and 'egress' are alternative keywords for the same concepts.

VLAN 100 is a valid VLAN ID because Cisco IOS switches support VLANs in the range 1–1005 for normal-range VLANs, and VLAN 100 falls within this range. Normal-range VLANs are stored in the vlan.dat file and can be created on a standard IOS switch without requiring extended VLAN configuration.

The correct order starts with verifying the RSPAN VLAN exists and is active on all switches, then checking that trunk links carry the RSPAN VLAN, then confirming the source SPAN session is correctly configured, then inspecting the destination SPAN session, and finally using debug or monitor commands to isolate the issue.

EIGRP route summarization first requires enabling EIGRP, configuring the network statement, then entering interface configuration mode, applying the summary-address command, and finally verifying the summary route in the routing table.

class-map defines traffic classification criteria, policy-map defines the QoS actions to apply, service-policy applies the policy-map to an interface, class-map uses match statements, and policy-map uses class statements.

The output shows that SW2's Gi0/3 is in the Alternate (Altn) role and Blocking (BLK) state. In Rapid PVST+ (IEEE 802.1w), an alternate port provides a backup path to the root bridge and is placed in a blocking state to prevent Layer 2 loops. This confirms that Gi0/3 is blocking to maintain a loop-free topology.

RADIUS encrypts only the password attribute in the Access-Request packet using a shared secret and MD5 hash, leaving the rest of the packet (e.g., username, service type) in cleartext. TACACS+ encrypts the entire body of the packet (all fields except the standard header) using a shared secret and MD5-based encryption, providing confidentiality for all AAA information. This makes option B correct because it accurately describes the encryption scope difference between the two protocols.

The correct order starts with creating a dedicated VLAN for RSPAN traffic, then configuring the source switch to monitor traffic and forward it to that VLAN, followed by configuring the intermediate switches to transport the RSPAN VLAN, then configuring the destination switch to receive and analyze the traffic, and finally verifying end-to-end packet flow.

The command 'spanning-tree mode rapid-pvst' enables Rapid PVST+ (Per-VLAN Spanning Tree Plus) on the switch, which runs a separate instance of RSTP (802.1w) for each VLAN. This provides faster convergence than classic STP (802.1D) by using mechanisms such as sync/agreement handshakes, edge ports, and link types, while still maintaining per-VLAN topology independence.

LDP session establishment starts with Hello discovery via UDP, then TCP connection setup, LDP initialization with parameters, label exchange via KeepAlive and Label Mapping, and finally session up with full label exchange.

That the YANG models are operational data models and require the 'source-address' to be specified under the telemetry receiver, or the subscription must be for operational data. Actually, the most likely cause is that the engineer did not include the 'source-interface' configuration under the telemetry subscription, which is required for dial-out telemetry to ensure the router uses the correct IP address. The other options are incorrect because the collector is reachable, so firewall is not the issue; YANG models are correct; and gRPC is supported.

Key fields define a unique flow (e.g., source IP, destination IP, protocol). Non-key fields provide additional data (e.g., byte count, packet count, timestamps).

Model-driven telemetry (MDT) uses YANG data models and supports both periodic and on-change subscriptions. It uses a push model, reducing polling overhead. gRPC and gNMI are common transport protocols. Telemetry data can be encoded in JSON or GPB.

The correct order begins with importing the image into the image repository, then distributing the image to the device, then activating the image (setting it as the boot image), then rebooting the device, and finally verifying the new version. This ensures a controlled upgrade process.

To log commands via AAA accounting, you first enable AAA globally, then configure the accounting method list for exec or commands, apply it to the desired lines, and finally verify that commands are being sent to the accounting server.

The correct answers focus on Jinja2 templating and its integration with Python. The incorrect options either misstate Jinja2's capabilities (it does not execute commands), misidentify the library for YAML parsing (PyYAML, not Jinja2), or incorrectly claim that Python cannot be used for configuration generation (it can, via templates).

The 'ip ospf cost' command overrides the default cost calculation based on bandwidth. The network command matches both interfaces because they fall under 10.0.0.0/8.

The filter is passed as a string but the ncclient library expects a tuple with the filter type and the filter content. The correct syntax is filter=('subtree', filter_string). The code passes a single string, which will cause a TypeError.

In HA SSO, the active WLC fails, the standby detects the failure via RP link, takes over the active role, reinitializes interfaces, and then clients reassociate to the new active WLC.

Port security operates at Layer 2, ACLs at Layer 3, firewall at Layer 4, IPS at Layer 7, and 802.1X at Layer 2.

VRF-lite provides path isolation on a single router without MPLS. The correct answers describe that VRF-lite uses separate routing tables and that interfaces are assigned to VRFs. The incorrect options wrongly claim that VRF-lite requires MPLS or that it supports only static routing.

In YANG, container groups related nodes, leaf holds a single scalar value, list defines a sequence of entries, leaf-list is an array of scalar values, and typedef defines a derived type.

The output shows an entry for 1.1.1.1 with the label 'ABR' (Area Border Router) and a route type of 'i' (intra-area). An ABR connects two or more OSPF areas, so Router 1.1.1.1 must be connecting Area 0 to another OSPF area. The metric [110/10] and next-hop 192.168.1.1 confirm it is reachable within Area 0.

GET, GETNEXT, GETBULK, and SET are initiated by the manager; TRAP and INFORM are initiated by the agent.

VLAN mapping requires first enabling the feature globally, then configuring the trunk interface, mapping the VLANs, and finally verifying the translation. The order ensures proper translation between customer and service provider VLANs.

TACACS+ uses START to initiate authentication, REPLY to respond with prompts or success/failure, CONTINUE to send user responses, and also has special types for authorization and accounting.

Cisco DNA Center Assurance relies on telemetry data collected via NETCONF/YANG or gRPC, not just SNMP. If the switches are not configured for telemetry, Assurance will not receive the necessary data. SNMP is used for inventory and basic monitoring, but not for the rich telemetry required by Assurance.

IP addressing design starts with gathering requirements, then choosing a private address space. Subnetting is applied to create subnets, which are assigned to specific network segments, and finally summarized to reduce routing table size.

The configuration must first specify the session, then define sources and filter VLAN, and finally activate the session.

Cisco DNA Center uses a declarative model for network configuration. In a declarative model, the administrator specifies the desired end-state of the network (e.g., 'VLAN 10 should exist on all access switches'), and DNA Center's automation engine determines the necessary steps to achieve that state, handling dependencies and ordering automatically. This contrasts with imperative models where each step must be explicitly scripted.

The GOLD class has a queue-limit of 64 packets, while the SILVER class has a queue-limit of 128 packets. Under congestion, the smaller queue for GOLD will fill up faster, leading to more tail drops for GOLD traffic, even though both classes are allocated the same bandwidth percentage. This demonstrates that queue-limit directly affects drop probability, not bandwidth allocation.

Type 1 hypervisors run directly on hardware and are common in data centers; Type 2 run on a host OS and are used for desktop virtualization.

SNMPv3 provides three security models: noAuthNoPriv (no authentication, no encryption), authNoPriv (authentication but no encryption), and authPriv (authentication and encryption). The authPriv model uses HMAC-MD5 or HMAC-SHA for authentication and CBC-DES or CFB128-AES for encryption. The engine ID is a unique identifier for each SNMP entity and is used to generate the localized key.

Standard ACLs filter only source IP; Extended ACLs filter source/dest IP, protocol, and ports; Named ACLs allow alphanumeric naming; Time-based ACLs restrict based on time of day.

MSDP allows RPs in different domains to share information about active sources. When an RP learns of a new source, it sends a Source-Active (SA) message to its MSDP peers. The peer RP then creates an (S,G) state and can join the source if there are interested receivers.

DACL filters traffic, VLAN assigns network segment, SGT tags traffic for TrustSec, URL redirect forces web authentication.

LACP first exchanges system priority to determine which side is active, then exchanges port priorities to select which ports bundle, next negotiates the operational key, then forms the bundle by synchronizing parameters, and finally the port channel interface becomes operational. This order follows the LACP state machine as defined in IEEE 802.3ad.

Validation starts by loading the YANG model, parsing the path, checking it against the schema, testing it on a device, and then confirming the output.

Virtual routers, firewalls, and load balancers are common VNF categories.

Passive state indicates a stable route; Active state indicates the router is querying neighbors; Local Computation occurs when a feasible successor exists; Diffusing Computation occurs when no feasible successor exists; Query Origin is the router that starts the query process.

FlexConnect allows APs to locally switch client traffic and to function independently when the WLC is unreachable, but it does not support all encryption methods (e.g., CCKM is not supported in FlexConnect local switching mode) and it does not support rogue detection in standalone mode.

Cisco ISE evaluates RADIUS policies in a specific order: first authentication policies, then authorization policies (based on conditions), and finally the default rule if no match is found. This ensures proper access control.