ENCOR 350-401 (350-401) — Questions 301–375

The `requests.delete()` method sends an HTTP DELETE request to the RESTCONF API endpoint for VLAN 10. When the VLAN exists, the device processes the DELETE operation and removes the VLAN configuration from the running config, returning a 204 No Content status code upon success.

The CLI configuration begins by entering global config, defining the receiver, setting the subscription parameters, applying the subscription, and verifying it.

IKEv2 uses UDP port 500 and 4500, supports EAP authentication, and is more robust than IKEv1. It does not use TCP, and it supports multiple simultaneous SAs.

Dial-in models require the collector to initiate the connection (e.g., gRPC dial-in). Dial-out models let the network device push data to the collector (e.g., gRPC dial-out, NETCONF YANG-push).

Ansible Vault encryption starts with creating a password file; then, encrypting a plaintext file with ansible-vault encrypt; next, viewing the encrypted content with ansible-vault view; after that, decrypting the file for editing with ansible-vault decrypt; finally, re-encrypting after modifications.

vManage provides centralized management and monitoring; vSmart distributes control plane policies and OMP routes; vBond authenticates and orchestrates initial device onboarding and NAT traversal.

cisco_ios maps to IOS, cisco_nxos to NX-OS, cisco_xr to IOS-XR, and cisco_xe to IOS-XE. The fifth pair cisco_asa maps to ASA.

STP is 802.1D; RSTP is 802.1w; MSTP is 802.1s; PVST+ is a Cisco proprietary extension of 802.1D.

PAgP negotiation begins with ports in auto mode sending PAgP packets, then desirable mode ports reply with PAgP messages, followed by negotiation of parameters, agreement on bundle membership, and finally ports are bundled into EtherChannel.

The DHCP snooping feature treats all ports as untrusted by default, which means DHCP server messages (DHCPOFFER, DHCPACK, DHCPNAK) are dropped on untrusted ports. Since the DHCP server is connected to a trunk port and DHCPACK messages are being dropped, that trunk port must be explicitly configured as a trusted port for DHCP snooping using the 'ip dhcp snooping trust' interface command. This allows legitimate DHCP server responses to reach clients, resolving the duplicate IP address issue caused by clients not receiving their assigned addresses.

The configuration is missing an IKEv2 proposal and an IKEv2 policy, which define the encryption, integrity, and DH group parameters for the IKEv2 SA. The profile must reference these via the 'proposal' command under the IKEv2 proposal or the 'match proposal' command under the IKEv2 policy; without them, the router has no agreed-upon parameters to negotiate with the peer, so the tunnel cannot be established.

The 'encoding encode-kvgpb' specifies that the telemetry data should be encoded using KVGPB (Key-Value Google Protocol Buffers), which is a compact binary encoding used for efficient data transmission.

The correct order starts with defining the top-level site (e.g., continent or country), then adds the area, then the building, then the floor, and finally assigns the floor plan. This hierarchical structure is required for proper network segmentation and assurance in Cisco DNA Center.

DNA Center provides centralized image management with golden images, distributed upgrades, and compliance checks. The correct answers cover these key features. The incorrect options confuse image management with configuration backup or misstate the upgrade process (no automatic reboot without approval).

Configuration begins with selecting hash algorithm, then applying it globally, verifying on interfaces, checking load distribution, and finally adjusting if needed.

get_facts returns device facts like hostname and OS version, get_interfaces returns interface details, get_bgp_neighbors returns BGP neighbor information, get_lldp_neighbors returns LLDP neighbor data, and get_environment returns power and fan status.

EIGRP named mode uses a hierarchical configuration under a single router process, supporting address families (IPv4, IPv6) and VRFs. It simplifies configuration and allows per-interface settings.

SGT is the tag, SGACL is the policy, SXP propagates tags, MACsec encrypts the link.

Ansible modules are designed to be idempotent, meaning repeated runs produce the same state. The 'command' and 'shell' modules are not idempotent by default. Modules like 'copy' and 'template' check current state before making changes.

Administrative distances are used to select the best route when multiple routing protocols provide routes to the same destination.

EIGRP uses a maximum hop count of 255 to prevent routing loops, as defined in RFC 7868. This is a hard-coded limit in the protocol, and routes with a hop count exceeding 255 are considered unreachable.

IP Source Guard first builds the binding from DHCP snooping, then installs a per-port ACL to permit only the bound IP, applies the ACL to the access port, checks all incoming IP traffic against the ACL, and drops any traffic with a source IP not in the binding.

The correct order starts with the PE learning the customer route via IGP or static, then redistributing it into MP-BGP as a VPNv4 route with a route distinguisher, advertising it to the other PE via MP-BGP update, the receiving PE importing the route based on matching route targets, and finally installing the route into the appropriate VRF.

Security Group Access Control Lists (SGACLs) are a core component of Cisco TrustSec, enforcing role-based access control by applying policies based on Security Group Tags (SGTs). SGACLs replace traditional IP-based ACLs, allowing dynamic, identity-aware traffic filtering that scales across the network.

DNA Center is the management and automation platform for SD-Access. The correct answers describe its role in fabric design and policy enforcement. The incorrect options misrepresent the control plane (LISP, not OSPF), the border role (fabric exit, not WAN), and the device role (edge, not core).

The correct order begins with physical connectivity and discovery, followed by adding the device to inventory, assigning it to a site, configuring the network profile and fabric role, and finally provisioning the node. This sequence ensures the device is discovered, recognized, and properly configured within the SD-Access fabric.

NetFlow v9 export starts with packet arrival, then flow creation and cache update. When export conditions are met, the template is sent first, followed by data records. Finally, the flow is aged out.

vSphere Replication operates at the hypervisor level, replicating VM data from the source ESXi host to the target ESXi host. For NFS datastores, the source and target hosts must each have the NFS datastore mounted because vSphere Replication reads the VM files from the source NFS mount and writes them to the target NFS mount. Without both mounts, the replication engine cannot access the source data or place the replica on the target storage.

The correct order follows the Cisco SD-WAN device bootstrapping process: first the device obtains an IP address via DHCP, then it discovers the vManage using DNS or a redirect server, establishes a DTLS/TLS control connection to vManage, downloads its configuration, and finally establishes OMP sessions with vSmart controllers.

The process starts with authenticating to the device's REST API, then constructing the GET request for the interface statistics endpoint. The device processes the request, retrieves the data, and sends a JSON response. The client then parses the JSON to extract the statistics.

The Cisco SD-WAN control plane consists of vSmart controllers that distribute OMP routes and vBond orchestrators that authenticate and onboard devices. vEdge routers are data plane devices, not control plane. vManage is a management plane component. TLOCs are used for transport location identification, not for route redistribution.

Standard ACLs filter only source IP; Extended ACLs filter source/dest IP, protocol, and ports; Named ACLs allow identification by name; Time-based ACLs use time ranges; Dynamic ACLs authenticate per-user.

The 'secret' parameter is used to enter enable mode (privileged EXEC mode) on Cisco devices. Netmiko will automatically use this password to elevate privileges after connecting.

noAuthNoPriv provides no authentication or encryption; authNoPriv provides authentication only; authPriv provides both authentication and encryption.

Data VLAN carries user traffic; voice VLAN carries VoIP; management VLAN for device access; native VLAN for untagged frames on trunk; default VLAN is VLAN 1.

A is correct because spine-leaf architecture ensures that every leaf switch is connected to every spine switch, creating a full-mesh topology. This design guarantees that traffic between any two leaf switches traverses at most one spine hop, resulting in predictable, consistent latency regardless of which devices are communicating.

WPA3 uses Simultaneous Authentication of Equals (SAE) handshake. The client first sends an SAE commit to the AP, the AP responds with its own SAE commit, then both compute a shared key. Next, the client sends an SAE confirm message, and finally the AP sends its SAE confirm to complete authentication.

CoPP first classifies traffic using an access list, then matches it to a class map, then applies a policy map with a police action (rate-limit), activates the policy on the control plane, and finally the hardware performs policing.

sFlow begins with the agent sampling packets at a configured rate, then extracts header and counter information, encapsulates the sample into an sFlow datagram, sends the datagram to the collector via UDP, and finally the collector analyzes the samples for monitoring.

Key fields define the flow identity (e.g., IP addresses, ports, protocol). Non-key fields provide additional information about the flow (e.g., packet counts, timestamps, TCP flags).

Cisco DNA Center uses intent-based APIs and templates to automate network provisioning. The correct answers highlight key automation capabilities: PnP for zero-touch deployment and template-based provisioning for consistent configuration. The incorrect options misrepresent the GUI-only nature (CLI is also available via templates), the role of Assurance (monitoring, not configuration), the scope of SD-Access (fabric, not all devices), and the integration method (REST APIs, not SNMP).

The workflow begins by importing required modules (threading and Netmiko), defining a function for device connection and command execution, creating a list of devices, then using threading.Thread to spawn threads for each device, and finally joining threads to wait for completion.

In Ansible Tower/AWX, a job template execution starts with creating the template, launching it, which triggers inventory and credential resolution, then the playbook runs, and finally the job output is displayed for review.

A process or kernel generates a syslog message with a facility and severity, the syslogd daemon compares the severity to the configured logging level, then writes the message to the local buffer, optionally forwards it to a remote syslog server, and finally the message is stored or displayed.

Extra-vars override all others, role defaults have lowest precedence, host vars apply per host, group vars apply per group, and play vars apply to the entire play.

First establish NETCONF session, then subscribe to YANG data, then receive periodic updates, and finally unsubscribe.