ENCOR 350-401 (350-401) — Questions 1–75

VNFM manages individual VNFs; NFVO orchestrates network services; VIM controls NFVI resources.

The 'threshold-type immediate' parameter in an IP SLA reaction configuration causes the router to trigger the specified action (in this case, 'triggerOnly') as soon as a single probe timeout occurs, without waiting for any additional probes or a delay. This is correct because the configuration explicitly sets the threshold type to immediate, meaning the reaction is instantaneous upon detecting the timeout event.

DNA Center integrates with various systems for extended functionality. The correct answers cover REST API integration, syslog forwarding, and IPAM synchronization. The wrong answers incorrectly claim direct BGP peering for routing and that SNMP traps are the only northbound interface.

IS-IS is the correct choice because it is a link-state routing protocol that provides fast convergence, is highly scalable, and is the most commonly recommended routing protocol for the underlay of an SD-Access fabric. Cisco SD-Access designs frequently use IS-IS to support the fabric's control plane and data plane requirements, leveraging its ability to handle large, flat network topologies with minimal overhead.

The correct order starts with importing the NAPALM library, then establishing a connection to the device, calling get_facts() to retrieve device facts, processing the returned dictionary, and finally closing the connection to free resources.

First create the SVI interface, assign an IP address, enable it, and then configure routing or ACLs as needed.

Hierarchical LAN design starts with the access layer for endpoint connectivity, then the distribution layer for policy and aggregation, followed by the core layer for high-speed transport. After physical design, VLANs and trunking are configured, and finally routing protocols are deployed for inter-VLAN communication.

VXLAN is the encapsulation protocol used in the Cisco SD-Access fabric to carry data plane traffic between fabric edge nodes. VXLAN provides a Layer 2 overlay over a Layer 3 underlay, enabling scalable segmentation and mobility without VLAN limitations.

DHCP snooping builds a binding table used by DAI. The switch validates DHCP messages, creates bindings, then intercepts ARP packets and compares them against the binding table to prevent spoofing.

Control messages manage the AP (e.g., configuration, keepalive); Data messages carry user traffic; Discovery messages find controllers; Join messages establish the AP-controller association; Configuration messages push settings to the AP.

The correct order begins with removing any existing SPAN session, then specifying the source interfaces or VLANs to monitor, then defining the destination interface for the analyzer, then optionally enabling encapsulation replication for trunk ports, and finally verifying the session is active.

dict stores key-value config pairs like interface settings, list stores ordered config lines, tuple stores immutable device credentials, set stores unique VLAN IDs, and frozenset stores immutable sets of allowed protocols.

VXLAN encapsulates Layer 2 frames in UDP packets over IP, allowing Layer 2 segments to be stretched across Layer 3 networks. This enables virtual machine mobility and multi-tenant environments without being constrained by physical network boundaries.

NETCONF/YANG is a valid method for automating network device configuration on Cisco IOS XE. NETCONF (RFC 6241) uses an XML-based RPC protocol to establish a secure SSH session (port 830) for configuration operations, while YANG (RFC 7950) provides a structured data model to define the configuration and state data. This combination allows for programmatic, transactional, and standardized configuration management, making it a core automation technology supported by Cisco.

The output shows three remote bindings, each from a different LSR (10.9.9.1:0, 10.9.9.2:0, and 10.9.9.3:0), advertising a label for the prefix 10.9.9.0/24. The local binding (label 22) is not a remote peer, so only the three remote entries count. Therefore, the correct answer is 3.

The source-interface command ensures that all telemetry packets sent to the receiver use the IP address of Loopback0 as the source.

Graceful restart begins with the restarting router sending an OPEN message with the graceful restart capability, followed by the peer acknowledging, then the restarting router marking routes as stale, and finally the peer sending End-of-RIB markers.

This question tests detailed knowledge of DHCP snooping operation and configuration, including trusted/untrusted ports and option 82.

The output shows two NAT entries with the flag 'static' and a timeout of 'never'. Static NAT translations are manually configured and persist indefinitely in the translation table until explicitly removed by an administrator. This is why option D is correct.

WPA uses TKIP with PSK or 802.1X; WPA2 uses CCMP (AES) with PSK or 802.1X; WPA3 uses GCMP-256 with SAE or 802.1X; WPA2-Personal uses PSK; WPA3-Enterprise uses 802.1X with GCMP-256.

PAT translates private source IPs to a public IP with unique port numbers. The host sends a packet, the router creates a translation entry, replaces the source IP and port, forwards the packet, and reverses the process on the return.

The anti-replay check in IPsec uses sequence numbers to protect against replay attacks. When packets arrive out of order, the anti-replay window (default size 64 or 1024 packets) may reject packets that fall outside the window, causing the counter to increment. This is typical when traffic takes multiple paths, as packets can be reordered before reaching the peer.

Tail-drop drops all packets when queue is full; RED starts dropping packets probabilistically before queue full; WRED uses IP precedence or DSCP to vary drop probability per class.

Each component has a distinct role: Inventory defines managed nodes, Playbook is the execution blueprint, Role organizes content, Module is the execution unit, and Handler reacts to changes.

EF PHB (DSCP 46) is for low-loss, low-latency traffic; AF PHBs (AF1x-AF4x) provide assured forwarding with four classes and three drop precedences; CS PHBs (CS1-CS7) are backward-compatible with IP precedence; BE (DSCP 0) is best-effort; DF (DSCP 0) is the default PHB.

PPPoE session establishment begins with the Discovery stage: the client sends a PADI to find a server, the server responds with a PADO, the client selects a server and sends a PADR, the server assigns a session ID via PADS. Finally, the PPP link is negotiated using LCP and authentication.

GET retrieves; POST creates; PUT replaces; DELETE removes; PATCH partially updates.

The response is a dictionary with a key 'response' that contains a list. The list has one dictionary. To access 'overallHealth', you need to index the list and then the key.

Q-in-Q configuration requires first enabling the feature globally, then configuring the trunk port as a dot1q tunnel port, setting the native VLAN, and finally applying the service instance to encapsulate traffic. Verification ensures proper double-tagging.

802.1Q is an open standard that inserts a 4-byte tag, supports native VLAN, and is the default on modern switches. ISL is Cisco proprietary, encapsulates the entire frame, and does not support native VLAN.

Higher WEIGHT and LOCAL_PREF are preferred; lower MED, AS_PATH length, and IGP metric to next-hop are preferred.

The process starts with constructing the URI, then appending depth and field parameters, sending the GET request, the server filtering the response, and finally the client parsing the returned data.

When multiple BGP paths exist for the same prefix and the Weight attribute (Cisco proprietary, local to the router) is equal, the next tie-breaker in the BGP best path selection algorithm is the Local Preference (Local Pref). A higher Local Preference value is preferred, and this attribute is used to influence outbound traffic from an AS. Since the question states weight is equal, Local Preference becomes the first differentiator.

The default EIGRP hello interval on a point-to-point serial link is 5 seconds. EIGRP uses different hello intervals depending on the media type: for high-speed broadcast links (e.g., Ethernet) and point-to-point links, the default is 5 seconds; for multipoint non-broadcast links (e.g., Frame Relay), the default is 60 seconds.

The vSmart controller is the centralized control plane component in Cisco SD-WAN that distributes routing information (OMP routes) and policies to all vEdge/cEdge routers. It maintains the control plane by separating route advertisement and policy enforcement from the data plane, which is handled by the vEdge routers. This separation allows the solution to scale to thousands of sites because vSmart controllers can be clustered and do not process actual data traffic.

The output shows the 'Service-policy input: QOS_POLICY_VRF_G' line, confirming that a QoS policy is applied inbound on GigabitEthernet0/0.900. The policy contains two user-defined class maps: CLASS_VOICE (matching DSCP EF) with a police rate of 1 Mbps and CLASS_DATA (matching DSCP AF31) with a police rate of 2 Mbps, both with conform/transmit and exceed/violate drop actions. This demonstrates that both voice and data traffic are being policed, making option C correct.

The spokes can establish the IKEv2 tunnel and ping the hub's tunnel IP, confirming that the tunnel interface is up and the IKEv2 session is functional. However, the loopback0 address (10.0.0.1/32) is not reachable from the spokes because it is not advertised into the routing protocol (e.g., OSPF, EIGRP, or BGP) used over the FlexVPN tunnel. Without a route to the loopback0 prefix, the spokes' traffic to 10.0.0.1 is dropped by the hub's routing table, even though the tunnel is operational.

The configuration uses the 'tx' keyword to specify that only traffic transmitted (egress) from GigabitEthernet1/0/6 should be copied to the destination interface GigabitEthernet1/0/7. Without the 'tx' keyword, the default behavior would be to monitor both ingress and egress traffic, but the explicit 'tx' limits the SPAN session to egress traffic only.

This configuration implements dynamic NAT with Port Address Translation (PAT), also known as NAT overload. The access list matches the 192.168.1.0/24 source network, and the 'ip nat inside source list 1 interface GigabitEthernet0/2 overload' command translates all matching inside local addresses to the single outside interface IP (203.0.113.1) using unique port numbers to differentiate sessions. This allows multiple internal hosts to share the public IP simultaneously.

Hello packets discover and maintain neighbor relationships; DBD packets contain a summary of the LSDB; LSR packets request specific LSAs; LSU packets send full LSAs in response to LSRs; LSAck packets acknowledge receipt of LSUs.

The script prints the site ID of the building if it exists. The output will be a string representing the UUID of the building.

Start-time defines when the operation begins; frequency sets the interval between probes; life sets the total duration of the operation.

The configuration is complete for VRF-lite OSPF routing. In VRF-lite, the 'vrf definition GREEN' with an RD, the interface assignment via 'vrf forwarding GREEN', and the OSPF process with 'vrf GREEN' and the network statement are all that is required. OSPF will operate correctly within VRF GREEN using the specified network in area 0.

class-map defines traffic classes; policy-map associates actions with classes; service-policy applies the policy to an interface or globally.

A virtual link connects a non-backbone area to Area 0 through a transit area. First, identify the ABR with the transit area, then configure the virtual link on both ABRs using the router ID of the neighbor, ensure the transit area has full OSPF adjacency, and finally verify the virtual link is operational.

In DMVPN Phase 3, when a spoke needs to send traffic to another spoke, it first sends data through the hub, the hub forwards the packet with a redirect, the spoke then sends an NHRP resolution request to the hub, the hub replies with the destination spoke's NBMA address, and finally the source spoke builds a direct mGRE tunnel to the destination spoke. The correct order is: spoke sends data through hub, hub sends redirect with NHRP trigger, spoke sends NHRP resolution request to hub, hub replies with destination spoke NBMA address, source spoke builds direct mGRE tunnel to destination spoke.

The 'country US' command in the AP profile sets the regulatory domain to the United States, which determines the allowed channels, maximum transmit power levels, and DFS requirements for the AP. This is a fundamental wireless configuration that ensures compliance with local regulations.

The output shows 'Number of successes: 100' and 'Number of failures: 0', with a 'Latest Operation Return Code: OK', indicating that the IP SLA operation has been consistently successful without any failures. The latest RTT of 25 ms and the absence of threshold violations confirm the operation is working correctly.

The output shows four interfaces: Gi0/1 (Root FWD), Gi0/2 (Desg FWD), Gi0/3 (Desg FWD), and Gi0/4 (Altn BLK). Three ports (Gi0/1, Gi0/2, Gi0/3) are in the Forwarding state, while Gi0/4 is in the Blocking state. Therefore, the correct answer is 3.

The correct order first defines the VRF, then configures the NAT inside and outside interfaces under the VRF, defines the NAT pool or ACL for translation, applies the NAT rule referencing the VRF, and finally verifies the translation with show ip nat translations vrf.

The `spanning-tree portfast` command on an access port configured with `switchport mode access` and `switchport access vlan 50` causes the interface to bypass the normal spanning-tree listening and learning states. This allows the port to transition directly to the forwarding state, enabling immediate traffic forwarding without the usual 30-second delay (15 seconds for listening, 15 seconds for learning) associated with Rapid Spanning Tree Protocol (RSTP) or the 50-second delay with classic STP (802.1D).

SNMPv3 introduced a security model that provides both authentication and privacy (encryption), but the question specifically asks for the version that introduced a username and authentication/password framework without encryption. SNMPv3's User-based Security Model (USM) allows for authentication-only mode (authNoPriv), which uses a username and password (or key) for authentication but does not encrypt the payload. This distinguishes it from earlier versions that relied on community strings (SNMPv1 and SNMPv2c) or offered no standardized security framework.

VRF-Lite uses only local VRFs without MPLS or MP-BGP, requiring trunk links; MPLS VPN uses MPLS labels and MP-BGP for scalable path isolation; VRF-Lite is simpler but limited to a single router or switch; MPLS VPN scales across an entire provider network; VRF-Lite does not support overlapping address spaces between sites without NAT.

The correct order for WRED configuration is: first define a class map matching TCP traffic (B), then create a policy map with the random-detect command (C), apply the service policy to an interface (D), and verify with show policy-map interface (E). Option A is a distractor; WRED is not enabled globally but per class under a policy map using the 'random-detect' command.

When a method list specifies RADIUS then local, the device first attempts RADIUS authentication. If the RADIUS server is unreachable (timeout), the device falls back to the next method in the list, which is local authentication using the local user database.