ENCOR 350-401 (350-401) — Questions 376–450

Cisco DNA Center includes a feature called 'Template Editor' (or 'Network Templates') that allows engineers to create CLI templates for device configuration. These templates can be parameterized and applied to devices during provisioning, ensuring consistent configuration across the branch.

DMVPN Phase 2 allows spoke-to-spoke tunnels after initial hub registration, uses mGRE on spokes, and supports dynamic routing between spokes. NHRP is used for resolution.

VTP requires setting mode and domain before trunking works; verification confirms operation.

The output shows R1 has a neighbor with state 2WAY/DROTHER (10.0.0.3), which indicates that R1 is also a DROTHER on this broadcast multiaccess segment. The FULL/DR neighbor (10.0.0.2) is the Designated Router, and since R1 is not the BDR (no FULL/BDR state), it must be a DROTHER.

Periodic sends at intervals, on-change sends on value change, target-defined leaves timing to the device, on-change-with-policy adds conditions, and periodic-and-on-change combines both.

Route Distinguisher (RD) makes IPv4 prefixes unique across VRFs; Route Target (RT) controls import/export of routes; the VRF RIB stores routes learned within that VRF; the global RIB holds routes for the global routing table; the FIB is used for forwarding decisions.

ERSPAN Type I uses a 4-byte GRE header with 4-byte session ID; ERSPAN Type II uses a 4-byte GRE header with an 8-byte ERSPAN header; ERSPAN Type III uses a 4-byte GRE header with a 12-byte ERSPAN header.

CoPP evaluates packets against class maps in sequential order. The first match determines the action. The default class is processed last if no match occurs.

LLQ for voice requires first classifying voice traffic, then creating a policy map with a priority queue, applying it to the interface, and verifying the configuration. The priority queue ensures low latency for voice packets.

Validation begins with loading the YANG model, then using the tool to check path syntax, verifying existence, and confirming with device capabilities.

EAP-TLS uses certificates, PEAP uses tunneled MSCHAPv2, EAP-FAST uses PAC, EAP-MD5 uses simple password hash.

EIGRP named mode uses an address-family configuration. First, create the named EIGRP instance, then enter address-family IPv4, configure the network, optionally adjust timers, and finally verify the configuration.

The output shows that VLANs 1-1005 are allowed on the trunk, but only VLANs 1, 10, and 20 are listed as active in the management domain. This means VLANs 2-9 are configured on the trunk but are not active (i.e., not created or not present on the switch), so they do not forward traffic. Option A correctly identifies this condition.

The manager collects data, the agent runs on the device, MIB defines the data structure, and OID identifies specific variables.

The correct order starts with importing the Netmiko library, then creating a device dictionary with connection parameters, establishing the SSH connection using ConnectHandler, sending a command (e.g., 'show ip interface brief'), and finally closing the connection with disconnect(). This sequence follows standard Netmiko workflow for device access.

The RSPAN VLAN must be dedicated to RSPAN only, cannot be the native VLAN, must be allowed on all trunk links between source and destination switches, and must not have any Layer 3 interface configured.

RADIUS uses UDP and encrypts only the password; TACACS+ uses TCP and encrypts the entire packet. RADIUS combines authentication and authorization; TACACS+ separates them. RADIUS is commonly used for network access; TACACS+ for device administration.

Cisco DNA Center's syslog collector listens on specific ports (default UDP 514). If the switch is configured to send syslog but DNA Center is not receiving it, a common issue is that the syslog port is blocked by a firewall or ACL between the switch and DNA Center. The engineer should verify network connectivity and port accessibility.

Protocol 1 is ICMP, 6 is TCP, 17 is UDP, 89 is OSPF, 2 is IGMP.

OMP attributes control route preference, TLOC mapping, and path selection. Site ID identifies the origin site; Originator identifies the vSmart that originated the route; Preference influences route selection; Tag is used for policy matching; TLOC carries the transport location endpoint.

NBAR2 configuration begins by enabling the protocol discovery, then creating a class map to match the application, a policy map to mark traffic, applying it to the interface, and verifying the classification. NBAR2 uses deep packet inspection to identify applications.

The exporter first sends a template set to the collector, the collector acknowledges, then the exporter sends data records using that template, and templates may be withdrawn or resent periodically.

H-QoS uses a child policy for per-class actions and a parent policy to shape aggregate traffic. The order ensures child policy is defined first, then parent references it, and finally applied to the interface.

TACACS+ separates authentication, authorization, and accounting. For command authorization, the user authenticates first, then the device sends the command to the TACACS+ server, which checks its authorization policy and responds with permit or deny. The device then executes or blocks the command accordingly.

RESTCONF GET retrieves data (like NETCONF get/get-config), POST creates a resource (like edit-config with operation create), PUT replaces a resource (like edit-config with operation replace), PATCH partially updates (like edit-config with operation merge), and DELETE removes a resource (like edit-config with operation delete).

CoS values are used in 802.1Q frames: CoS 5 for voice, CoS 4 for video, CoS 3 for call signaling, CoS 2 for critical data, CoS 0 for best-effort data.

ACLs are used within CoPP to classify control-plane traffic. CoPP can protect against DoS attacks, and ACLs provide the classification. The incorrect options misstate the order of processing or the scope of CoPP.

DSCP values map to specific PHBs: EF is for expedited forwarding, AF41 is Assured Forwarding class 4 low drop, CS3 is class selector 3, AF21 is Assured Forwarding class 2 medium drop, and BE (0) is best-effort.

The sFlow agent samples packets and sends datagrams. The collector receives and analyzes datagrams. The datagram is the packet sent from agent to collector.

NetFlow v5 uses fixed 7-tuple keys and is IPv4-only. NetFlow v9 is template-based and supports IPv6 and MPLS. IPFIX (NetFlow v10) is the IETF standard based on v9 with extensible fields.

sFlow agent: embedded in the network device, samples packets and sends datagrams. sFlow collector: receives and analyzes datagrams. sFlow datagram: the packet sent from agent to collector containing sampled data.

The correct order starts with creating an extended ACL to match the traffic (A), then defining a route-map using the match ip and set vrf commands (B), applying the route-map to the incoming interface (C), after which the router evaluates the policy for each packet (D), and finally matching packets are forwarded into the specified VRF (E). Configuration steps must precede operational steps.

gRPC is a supported transport protocol for telemetry receivers, along with gNMI and others.

uRPF first receives a packet on an interface, then looks up the source IP in the routing table, verifies that the incoming interface matches the best reverse path, and if it matches, forwards the packet; otherwise, it drops the packet.

RADIUS attribute numbers are standardized: User-Name=1, NAS-IP-Address=4, Service-Type=6, Framed-IP-Address=8, and Framed-Route=22.

Deploying CoPP requires first defining ACLs to classify traffic, then creating class maps, then a policy map, then applying it to the control plane, and finally verifying the policy.

The output shows 'Type: Remote Source Session', which indicates this is an RSPAN source session. The source ports Gi1/0/5 and Gi1/0/6 are configured to send mirrored traffic (TX only and RX only, respectively) to a destination port Gi1/0/20 with encapsulation set to 'Replicate', meaning the traffic is replicated onto an RSPAN VLAN for transport to a remote switch. This matches the definition of an RSPAN source session, where mirrored traffic is sent to a remote VLAN rather than a local destination.

Cisco DNA Center's Assurance module provides historical and real-time data for network devices. The 'Trends' feature allows engineers to view metrics like CPU utilization over a selected time period, helping to identify patterns and root causes.

Authentication verifies identity, authorization determines allowed actions, and accounting tracks usage for auditing or billing.

SXP propagates SGTs from a classification device to enforcement devices; first the SGT is assigned (e.g., via IP-to-SGT mapping), then SXP sends the binding to an SXP speaker, which forwards it to a listener, who adds it to the local SGT mapping table, enabling enforcement.

Subscribe is for streaming telemetry, Capabilities for discovery, Get for one-time retrieval, Set for configuration changes, and SubscribeOnce for one-shot subscription.

The fabric border node connects the fabric to external networks, the fabric edge node connects endpoints to the fabric, and the fabric control node manages LISP mapping and VXLAN tunnels.

The output shows a Remote Source SPAN (RSPAN) session. The 'Type: Remote Source Session' indicates that traffic from source ports Gi1/0/1-3 is mirrored and sent to a remote VLAN (the RSPAN VLAN) via the destination port Gi1/0/24, which acts as a reflector port. The 'Encapsulation: Replicate' means the destination port replicates the original frames without adding an extra VLAN tag, forwarding them onto the RSPAN VLAN for transport to a remote switch.

On-change subscriptions can generate high CPU load if the monitored data changes frequently, which may impact device performance.

MPLS TE tunnel setup using RSVP begins with IGP extension (OSPF/IS-IS) to flood TE link attributes, then CSPF computes the path, RSVP Path message is sent, RSVP Resv message reserves resources, and finally the tunnel is signaled and installed in the forwarding table.

EPC requires defining a capture buffer, defining a capture point, associating them, starting the capture, and then stopping/exporting.

MSTP configuration begins with entering MST configuration mode, assigning a region name and revision number, mapping VLANs to instances, and then activating the configuration. Finally, the MST instance priority is set to influence root bridge selection.

SWIM upgrade begins with importing the image, then distributing it to the device, performing a pre-check, activating the image, and finally committing the upgrade.

The process begins by loading the Jinja2 environment and template file, then defining a dictionary with configuration variables. Next, the template is rendered with those variables, the resulting configuration string is printed or saved, and finally it can be pushed to the device.

The 'state: present' parameter ensures that the telemetry subscription is created if it does not exist, or updated if it does. It is a common Ansible module parameter that idempotently manages configuration.

Deploying from a template begins with selecting the template and specifying a name and location. Next, the compute resource (host or cluster) is chosen, followed by storage. Customization specifications (like hostname and IP) are applied, and finally the VM is powered on.

START begins authentication and contains username; REPLY sends challenge or result; CONTINUE sends response to challenge; ACCEPT indicates successful authentication; REJECT indicates authentication failure.

The playbook uses ios_config to add a line globally. The command 'snmp-server community public RO' configures an SNMP community string 'public' with read-only access. This is a valid global configuration command.