Quick Answer

The correct order begins with enabling NBAR2 on the interface using the command ip nbar protocol-discovery, as this activates the deep packet inspection engine that identifies applications by their signatures. This step must come first because NBAR2 cannot classify traffic without first being enabled to collect application statistics. Next, you create a class-map to match the specific application using the match protocol command, followed by a policy-map to assign QoS actions like marking or policing. The policy-map is then applied to the interface in the outbound or inbound direction. Finally, verification with show ip nbar protocol-discovery confirms that the classification and marking are working. On the ENCOR 350-401 exam, this drag-and-drop sequence tests your understanding that NBAR2 configuration follows a logical order: enable, classify, act, apply, verify. A common trap is placing the class-map before enabling protocol-discovery, which would fail because NBAR2 isn’t yet active. Remember the mnemonic “E-C-A-A-V” (Enable, Classify, Act, Apply, Verify) to lock in the correct flow.