ENCOR 350-401 (350-401) — Questions 601–675

AAA accounting for commands requires first enabling AAA globally, then defining an accounting method list for commands. The method list is applied to a line (e.g., vty or console). The device then sends command logs to the accounting server, which records them.

Route targets (RTs) are BGP extended communities used in MPLS VPN to control route import and export between VRFs. The correct answers describe the role of RTs in importing routes into a VRF, exporting routes from a VRF, and the fact that multiple RTs can be configured per VRF. The incorrect options confuse RTs with route distinguishers (RDs) or claim that RTs are not used in VRF-lite (they are used in VRF-lite with BGP as well).

DSL uses telephone lines, Cable uses coaxial, Fiber uses optical, 4G LTE uses cellular, Satellite uses RF to orbit.

Successor is the next-hop router with the lowest metric; Feasible Successor is a backup that meets the feasibility condition; Neighbor is a directly connected EIGRP router.

The 'encoding encode-kvgpb' command specifies that the telemetry data should be encoded using the Key-Value Google Protocol Buffers (KV-GPB) format, which is a compact binary encoding used for efficient data transmission.

JSON_IETF uses JSON with IETF YANG encoding, protobuf uses Google Protocol Buffers, and kvGPB uses key-value pairs in GPB format.

The VPNv4 unicast address family carries MPLS VPN routes with RD and RT; IPv4 unicast carries standard IPv4 routes; IPv6 unicast carries IPv6 routes; VPNv6 unicast carries IPv6 MPLS VPN routes; L2VPN address family carries Layer 2 VPN information like VPLS.

class-map defines traffic classification criteria, policy-map defines the QoS actions to apply, service-policy applies the policy-map to an interface, class-map uses match statements, policy-map uses class statements.

DMVPN uses mGRE with NHRP; FlexVPN uses IKEv2 with per-peer tunnels; GET VPN uses GDOI for group encryption; AnyConnect uses TLS/DTLS for client-based remote access.

Over-threshold triggers when a metric exceeds the configured value; immediate triggers on the first violation; consecutive triggers after a specified number of consecutive violations.

The manager initiates a GetBulkRequest, the agent responds with multiple variables, and the process repeats until all OIDs are retrieved.

Cisco SD-WAN uses a centralized vSmart controller for policy and routing, vBond for orchestration and authentication, and vManage for management. vEdge routers establish secure DTLS/TLS tunnels to controllers and can use multiple transport interfaces. The control plane is separate from the data plane. vSmart does not forward data traffic.

The output shows a Remote Destination Session, meaning this switch (SW6) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 200 and forwards it out of the destination port Gi1/0/12. The 'Source RSPAN VLAN: 200' indicates the VLAN carrying the mirrored traffic from the source switch, and 'Destination Ports: Gi1/0/12' confirms the local egress interface for the mirrored packets.

First specify the session, then add source ports and direction, apply VLAN filter, set destination, and activate the session.

get_facts returns device info like hostname, vendor; get_interfaces returns interface details; get_bgp_neighbors returns BGP peer info.

802.11r provides Fast BSS Transition (FT); 802.11k provides Radio Resource Measurement (RRM) for neighbor reports; 802.11v provides BSS Transition Management (BTM) for network-assisted roaming.

PnP steps: Claim assigns a device to a site; Day0 Template applies initial configuration; Image Upgrade updates the device software; Provision deploys the full configuration.

In Cisco DNA Center, network profiles are used to define settings, but they must be applied to a site and then the devices must be provisioned with that site's settings. If the engineer only created the profile and assigned it to a site, but did not run the provisioning workflow (which pushes the configuration to devices), the VLAN will not be created.

'on-change' subscription because it triggers updates only when the monitored data changes, unlike periodic subscriptions that send data at fixed intervals. The other options are incorrect because 'periodic' sends data at a fixed interval, 'suppress-repetition' reduces duplicate updates in periodic subscriptions but does not enable on-change behavior, and 'sample-interval' is used for periodic subscriptions.

The correct order begins with the PE receiving a VPNv4 route from MP-BGP, checking the route target against the VRF import list, matching the RT to accept the route, installing the route in the VRF routing table, and then redistributing the route to the CE.

In GET VPN, a group member (GM) first registers with the key server (KS) using ISAKMP. The KS authenticates the GM and then pushes the current policy and encryption keys (TEK and KEK) to the GM. The KS periodically sends a rekey message to all GMs to update the keys before they expire.

Ansible playbook execution begins with inventory parsing to identify target hosts, then loads variables from group_vars/host_vars. Next, it gathers facts from the managed nodes, applies tasks from the playbook in order, and finally runs post-task handlers if notified.

The 'source-address' command specifies the IP address that the device uses as the source IP when sending telemetry data to the receiver. This ensures that the receiver can identify the device and that the traffic is sourced from a specific interface.

The correct activation steps are: (A) Enable root guard on designated ports, (B) Enable loop guard on non-designated ports, and (C) Verify root guard and loop guard status. Options D and E are not activation steps; they describe reactive states (root-inconsistent and loop-inconsistent) that may occur after enabling the guards. They should not be part of the ordered activation sequence.

IPFIX starts with the exporter defining a template with field definitions, then the exporter sends the template record to the collector, the collector acknowledges (optional), the exporter sends data records referencing the template ID, and finally the collector interprets data using the stored template.

OpenConfig: vendor-neutral YANG models. IETF: RFC-based YANG models. Cisco-IOS-XE: Cisco proprietary YANG models for IOS-XE.

T1 = 1.544 Mbps, E1 = 2.048 Mbps, DS3 = 44.736 Mbps, OC-3 = 155.52 Mbps, OC-12 = 622.08 Mbps.

VNFM manages individual VNFs, NFVO handles orchestration and resource inventory, VIM controls NFVI resources.

ios_config pushes configuration commands; ios_command executes show commands; ios_facts gathers device facts; ios_vlans manages VLAN configuration; ios_l3_interfaces configures Layer 3 interfaces.

NAT64 translates IPv6 packets to IPv4. The IPv6 host sends a packet to a synthetic IPv6 address, the router extracts the embedded IPv4 destination, creates a NAT64 binding, translates headers, and forwards the IPv4 packet.

Cisco DNA Center Assurance can correlate client association failures with RF interference, authentication issues, or configuration mismatches. Since the APs are registered and functional, the issue is likely related to RF interference or signal quality. DNA Center's Assurance can analyze client association events and highlight RF issues as a common cause.

The order starts with enabling NUMA in the BIOS, then configuring the hypervisor, creating the VM with NUMA settings, and finally verifying placement and performance.

In Cisco DNA Center, network profiles are applied to sites, but devices must be assigned to the correct site hierarchy. If a device is not assigned to the site where the profile is applied, it will not receive the configuration. The engineer should verify that the device is in the correct site within DNA Center's hierarchy.

200 OK indicates success, 201 Created indicates resource creation, 400 Bad Request indicates client error, 401 Unauthorized indicates authentication failure, 404 Not Found indicates missing resource, and 500 Internal Server Error indicates server failure.

OSPF requires the forwarding address (FA) in a Type 5 LSA to be reachable via an OSPF internal route (intra-area or inter-area) for the external route to be installed in the routing table. If the FA is not reachable, the router will ignore the LSA and not install the route, even though the LSA exists in the OSPF database and the neighbor adjacency is up.

The correct order starts with importing the NAPALM library and driver, then creating a driver object with device credentials, calling the open() method to establish the connection, invoking get_facts() to retrieve device facts, and finally closing the connection.

Local mode provides normal client access with CAPWAP tunnel; FlexConnect switches client traffic locally at the AP; Monitor mode listens for rogue devices; Sniffer mode captures packets for analysis; Rogue detector mode detects rogues without serving clients.

Cisco TrustSec uses SGTs for role-based access control, can use 802.1X for initial authentication, and supports dynamic SGT assignment via RADIUS. SGTs are not IP-based but are 16-bit tags. CTS does not replace all ACLs but augments them with SGT-based policies.

First enter the trunk interface, configure encapsulation, then apply the VLAN mapping policy (translate or map), and finally verify the mapping.

Open mode allows traffic before authentication, closed mode blocks all until authenticated, and monitor mode logs but does not block.

Cisco switches have limits on the number of SPAN/RSPAN sessions, typically up to 2 local SPAN sessions and 1 RSPAN source session. A single port can be a source for multiple sessions, but a destination port can only be used in one session at a time. The source and destination ports must be on the same switch for local SPAN.

Reflexive ACLs work by evaluating outbound traffic, creating a reflexive entry, then applying inbound ACL to permit return traffic. The order ensures proper dynamic inspection.

To retrieve the status of a task, a GET request should be sent to the provided URL. The task ID is used to query the task API endpoint.

The cisco.ios.ios_config module first connects to the device; then, it retrieves the running configuration; next, it compares the desired config lines with the running config; after that, it applies only the lines that are missing or different; finally, it saves the configuration if the save parameter is set.

Authentication typically uses RADIUS, authorization uses TACACS+, accounting can use either, but RADIUS is more common for accounting; TACACS+ encrypts the entire packet and separates AAA functions.

EPC requires defining a capture buffer, then a capture point, associating them, starting the capture, and finally exporting or viewing.

A FlexConnect AP first discovers and joins the WLC, then downloads its configuration and policy. When a client associates, the AP locally switches traffic if configured. The AP sends client data to the WLC for authentication and then applies the downloaded policy locally.

SVI configuration requires first creating the VLAN, then the SVI interface, assigning an IP address, enabling the interface, and finally verifying routing. This order ensures the VLAN exists before the SVI is created and routing is enabled.

FlexVPN IKEv2 spoke registration starts with the spoke initiating an IKEv2 SA to the hub, followed by authentication using certificates or pre-shared keys, then the spoke sends a configuration payload request, the hub assigns an IP address and pushes policies, and finally the spoke installs the IPsec SA and routes traffic through the hub. The correct order is: initiate IKEv2 SA to hub, authenticate using certificates or PSK, send configuration payload request, hub assigns IP and pushes policies, spoke installs IPsec SA and routes traffic.

The trust boundary process starts by enabling trust on the interface, then optionally setting a default CoS/DSCP for untrusted traffic, and finally applying a service policy to enforce policing or marking. Verification ensures the trust boundary is correctly applied.

224.0.0.0/24 is reserved for link-local multicast (e.g., routing protocols); 232.0.0.0/8 is for SSM; 239.0.0.0/8 is for administratively scoped (private) multicast; 224.0.1.0–238.255.255.255 is for global unicast-based multicast; 224.0.0.0/4 is the overall multicast range.

The output shows a Remote Destination Session, meaning this switch (SW9) is the destination switch in an RSPAN configuration. It receives mirrored traffic from RSPAN VLAN 300 and forwards it out of the destination port Gi1/0/40. The 'Source RSPAN VLAN: 300' indicates the VLAN carrying the mirrored traffic from the remote source switch, and 'Destination Ports: Gi1/0/40' confirms the local egress port.

The order begins with the ingress PE receiving an IP packet from the CE, looking up the VRF to find the next hop and label, pushing the MPLS label stack, forwarding the labeled packet across the MPLS core, and finally the egress PE popping the label and forwarding the IP packet to the destination CE.

If the source router has a default route pointing to the same next-hop, the IP SLA probe packets may be sent out using that default route, which could lead to the probe being sent to a different path or looping. However, the more direct cause is that the IP SLA probe is sourced from an interface that is not the one that would be used to reach the next-hop, so the probe may succeed even if the next-hop is unreachable via the expected path.