ENCOR 350-401 (350-401) — Questions 151–225

Standard ACLs are configured by first entering global configuration mode, then defining ACL entries with permit or deny statements, where each entry specifies a source IP and wildcard mask. After defining all entries, the ACL is applied to an interface in the inbound or outbound direction. Finally, verification with 'show access-lists' confirms the ACL is active and shows hit counts.

Thin provisioning allocates space on demand, thick provisioning allocates full space at creation, RDM provides direct LUN access, VMDK is VMware's virtual disk format, and VHDX is Hyper-V's virtual disk format.

network_cli uses SSH for CLI-based devices; netconf uses SSH for NETCONF-based devices; httpapi uses HTTP/HTTPS for REST APIs like NX-API or IOS-XE RESTCONF.

EAP-TLS uses certificates, PEAP uses server certificate with inner MSCHAPv2, EAP-FAST uses a PAC, and EAP-MD5 uses simple password hash.

SPT is the shortest path from source to receivers; RPT is a shared tree rooted at the RP; Bidirectional tree allows traffic to flow both ways; Source tree is a tree rooted at the source; Shared tree is a tree rooted at the RP.

802.11b operates at 2.4 GHz with 11 Mbps; 802.11a at 5 GHz with 54 Mbps; 802.11g at 2.4 GHz with 54 Mbps; 802.11n can use both 2.4 and 5 GHz with 600 Mbps; 802.11ac operates only at 5 GHz with up to 6.9 Gbps.

OPEN establishes peering; UPDATE advertises/withdraws routes; NOTIFICATION signals errors; KEEPALIVE maintains session; ROUTE-REFRESH requests re-advertisement.

The output shows a local SPAN session with the destination port Gi1/0/20 configured with 'Ingress : Enabled'. This means the destination port can forward incoming traffic (traffic received on Gi1/0/20) in addition to sending mirrored traffic from the source port Gi1/0/1. By default, a SPAN destination port drops all incoming traffic, but enabling ingress allows it to process and forward incoming frames.

Stateless DHCPv6 uses SLAAC for addressing and DHCPv6 for additional parameters. The host sends an RS, receives an RA with the O flag, then sends an Information-Request and receives a Reply with options like DNS.

vManage provides centralized management and monitoring; vSmart is the control plane controller that distributes routing and policy; vBond handles authentication and orchestration of the overlay network.

TrustSec inline tagging starts with the ingress switch classifying traffic and adding an SGT to the frame, then forwarding it across the fabric, the egress switch reading the SGT, matching it to an SGACL, and finally enforcing the permit/deny decision.

Push adds a new label to the stack, pop removes the top label, swap replaces the top label with a new one, PHP pops the label before the egress LER, and TTL propagation copies the IP TTL into the label TTL field.

The correct order starts with defining the external network, then creating the SVI for the handoff, configuring the routing protocol, applying the border handoff policy, and finally verifying the connectivity. This sequence ensures the border node can properly connect the fabric to external networks.

The output shows two types of NAT entries: a dynamic PAT entry for UDP (192.0.2.20:1234) and TCP (192.0.2.20:5678), and a static one-to-one translation for 192.0.2.21 to 10.0.0.21 (indicated by '---' in the protocol and port fields). This combination of dynamic PAT and static NAT on the same router confirms that both static NAT and PAT are being used simultaneously.

The flow starts with endpoint authentication via 802.1X/MAB, then ISE collects profiling data (e.g., DHCP, HTTP). ISE matches the endpoint to a profiling policy, assigns an identity group, and finally applies the appropriate authorization policy (e.g., SGT, VLAN).

The NETCONF get-config operation begins with establishing a secure SSH session, then the client sends a hello message to exchange capabilities. After the server responds with its hello, the client sends the get-config request. The server retrieves the configuration and sends the reply.

Policing drops or re-marks packets that exceed a configured rate, while shaping buffers excess packets and delays them to smooth traffic. Policing can be applied inbound or outbound, but shaping is typically outbound only. Shaping uses a buffer, which can introduce jitter.

Method lists define the order of authentication sources. The default login method uses local as fallback; a common RADIUS-first list uses local; a TACACS+-first list uses local; a local-only list uses no fallback; and a none list allows access without authentication.

LDP session establishment starts with discovering neighbors via Hello messages over UDP, then opening a TCP connection. The LSRs exchange initialization parameters over TCP, followed by Keepalive messages to confirm the session. Finally, label mappings are exchanged for FECs.

DACL filters traffic, VLAN assignment places the endpoint, and SGT tagging applies a security group tag.

DNA Center API categories map to endpoint groups: Know Your Network includes inventory and topology; Site Management handles building and floor details; Connectivity covers network device discovery; Operational Tasks includes software image management and device reboot.

OMP route advertisement begins with the vEdge learning a route locally, then originating an OMP route and sending it to vSmart, which processes and installs it in the route table, then advertises it to other vEdge routers, and finally the receiving vEdge installs the OMP route into its forwarding table.

SWIM in DNA Center automates image upgrades and compliance. The correct answers describe golden image definition and remote upgrade capabilities. The wrong answers incorrectly claim mandatory TFTP usage, lack of compliance reporting, and that SWIM only works with specific hardware models.

The Multi-Exit Discriminator (MED) is a BGP path attribute used to influence inbound traffic to an AS from multiple entry points. A lower MED value is preferred over a higher one, making it the correct answer among the options where the lowest value is preferred.

The underlay uses IS-IS for physical connectivity, the overlay uses VXLAN and LISP for encapsulation and location mapping, and the policy layer uses CTS for SGT-based segmentation.

Backbone area (0) connects all other areas; Stub area blocks Type 5 LSAs but allows Type 3; Totally stubby area blocks both Type 5 and Type 3 (default route only); NSSA allows Type 7 LSAs for external routes but blocks Type 5; NSSA totally stubby blocks Type 5 and Type 3 but allows Type 7.

CAPWAP Control messages manage the AP (e.g., keepalive, configuration); CAPWAP Data messages carry user traffic between AP and WLC.

The CAPWAP process starts with the AP obtaining an IP address (via DHCP), then discovering the WLC (via DHCP option 43 or DNS). The AP sends a Discovery Request, the WLC replies with a Discovery Response, and finally the AP sends a Join Request to establish the control tunnel.

Correct pairings: JSON is human-readable and widely used in REST APIs; XML is verbose with schema support; YAML is human-friendly for configuration files; Protobuf is a compact binary format for high-performance RPC.

SNMPv3 first discovers the engine ID, then negotiates authentication, then privacy, and finally processes the request.

K1 corresponds to bandwidth, K2 to load, K3 to delay, and K4 to reliability. K5 is not directly assigned to a single metric component; it is a multiplier used with reliability in the metric formula. MTU is not a K variable; it is only used in the feasibility condition.

Dynamic desirable actively negotiates trunking; dynamic auto waits for a neighbor to initiate; trunk forces trunking; access forces access mode; non-negotiate disables DTP.

ISL is Cisco proprietary with 30-byte header; 802.1Q is IEEE standard with 4-byte tag; only 802.1Q supports native VLAN; ISL encapsulates entire frame.

Port security limits unauthorized MAC addresses; violation mode defines action on violation.

GET retrieves a resource, POST creates a new resource, PUT updates/replaces a resource, DELETE removes a resource, and PATCH partially modifies a resource.

The correct order begins with opening a NETCONF session, locking the candidate datastore, sending the edit-config operation, committing the candidate to running, and finally unlocking the candidate datastore.

EIGRP uses a metric based on bandwidth and delay, but it also has a hop count limit. The default maximum hop count is 100, but it can be configured up to 255.

The output shows a Remote Source SPAN (RSPAN) session, where traffic on VLAN 30 (both sent and received) is replicated and sent out destination port Gi1/0/30. The 'Encapsulation: Replicate' indicates that the mirrored frames are forwarded unchanged to the destination port, which is typically connected to an RSPAN VLAN for transport to a remote monitoring device. Therefore, all traffic on VLAN 30 is mirrored and sent via Gi1/0/30 to a remote VLAN.

When using EtherChannel, the SPAN source must be the port-channel interface, not individual members, to capture all traffic.

Control policies affect routing decisions; data policies affect forwarding; app-route policies affect per-tunnel path selection; cflowd policies enable traffic flow monitoring.

Syslog severity levels range from 0 (Emergency) to 7 (Debug).

DNA Center Assurance provides proactive monitoring and troubleshooting using telemetry and AI/ML. The correct answers highlight its use of streaming telemetry, client health scoring, and proactive issue detection. The incorrect options confuse Assurance with automation (configuration changes) or misstate data sources (SNMP polling is secondary to telemetry).

A source port monitors all traffic on that specific port; a source VLAN monitors all traffic on all ports in that VLAN; an EtherChannel source monitors all traffic on all member links of the EtherChannel.

FIFO is the simplest queuing with no classification; WFQ provides fair bandwidth distribution; CBWFQ allows user-defined classes; LLQ adds a strict priority queue; PQ always services the highest-priority queue first.

Disabling Dynamic Trunking Protocol (DTP) on all access ports prevents a switch port from automatically negotiating a trunk, which is the primary vector for VLAN hopping attacks. An attacker can spoof DTP messages to force a port into trunking mode, gaining access to multiple VLANs; disabling DTP eliminates this risk.

Weight (highest) is checked first, then LOCAL_PREF (highest), then locally originated routes, then AS_PATH (shortest), then ORIGIN (IGP < EGP < incomplete).

Weighted Random Early Detection (WRED) is a congestion avoidance mechanism that proactively drops packets before a queue becomes full. By monitoring the average queue depth and dropping packets with a probability that increases as the queue depth grows, WRED signals TCP senders to reduce their transmission rate, thereby preventing tail drop and global synchronization. This differs from congestion management mechanisms like PQ or CBWFQ, which only act on packets after the queue is full.

RADIUS uses UDP, encrypts only the password, and combines authentication and authorization. TACACS+ uses TCP, encrypts the entire packet, and separates authentication, authorization, and accounting.

A standard ACL applied to the vty lines is the proper method to restrict SSH access to a router from a specific source network. Standard ACLs filter based on source IP address, and when applied to the vty lines with the 'access-class' command, they control which management hosts can initiate inbound SSH sessions to the router.