ENCOR 350-401 (350-401) — Questions 1–75

With IP SLA reaction-configuration, the 'immediate' threshold type is designed to trigger the event on the very first timeout occurrence, with no dependency on prior probe results. This means a single failed probe immediately generates the configured action (e.g., SNMP trap or track object state change), enabling the fastest possible detection of a failure. It is the default-like behavior for urgent alerting, but it does not consider any subsequent probe outcomes.

The RESTful API exposes inventory and topology programmatically, letting external applications pull live device and link data without manual export. This satisfies the integration requirement by providing northbound, standards-based access to Cisco DNA Center's network model.

IS-IS is the recommended underlay routing protocol for Cisco SD-Access because it is a link-state IGP that scales to large campus fabrics, supports both IPv4 and IPv6 natively, and converges rapidly after link or node failures. It runs directly over Layer 2 using CLNS, making it independent of IP addressing, which is valuable during underlay bootstrap. Fabric nodes use IS-IS to build a loop-free physical topology, and it can carry host-specific routes for seamless mobility.

The police rate of 8000 bps is too low for peak ARP traffic, causing legitimate ARP requests to be dropped. Increasing the rate to a value that matches normal peak traffic while still providing an upper bound protects the control plane without dropping legitimate traffic. This is the correct tuning approach for CoPP.

The 'mls qos trust dscp' command configures the interface to trust the DSCP value in incoming packets. This means the switch will use the existing DSCP marking for classification and queuing, rather than overwriting it. This is appropriate when the server is already marking its traffic with DSCP EF, as it preserves the marking and ensures proper treatment across the network.

This configuration statically enables trunking with `switchport mode trunk`, sets the native VLAN to 99 so that untagged frames are mapped to that VLAN, and uses the allowed VLAN list to permit only VLANs 10, 20, and 30 across the trunk. The combination restricts the trunk to the explicitly required VLANs while still allowing the native VLAN to be untagged, which matches the requirement exactly. Without the allowed list, the trunk would carry all active VLANs, so this command is the critical part that scopes the trunk.

Periodic telemetry pushes readings on a fixed schedule, so unchanged values are still transmitted. This satisfies the stem's interval-based collection model, in contrast to on-change notifications, which fire only when a monitored value actually differs from its previous state.

LDP hello messages are multicast on interfaces where LDP is explicitly enabled, typically via the 'mpls ldp' configuration. Because GigabitEthernet0/2 lacks this LDP configuration, it does not participate in LDP neighbor discovery or label binding exchange. Consequently, the LDP adjacency is confined to GigabitEthernet0/1, and only that interface exchanges label mappings; MPLS forwarding may still occur on Gi0/2 using labels learned from other sources, but no dynamic LDP labels are exchanged there.

In vManage, a preferred-color policy is enforced only after it is attached to a specific VPN or site list via the policy's 'Site and VPN' configuration. If the policy is not bound to the VPN that carries voice traffic, the vSmart controller will not inject the corresponding route attributes, leaving the traffic on its default path. Correct attachment is a prerequisite for any centralized policy to take effect, so a policy that is missing from the correct VPN or site list will silently do nothing.

Cisco SD-Access supports a dual-stack overlay, meaning that both IPv4 and IPv6 packets can be encapsulated in VXLAN and transported over an IPv4 underlay. This allows native IPv6 communication without translation. The underlay can remain IPv4, as the fabric data plane uses VXLAN with an IPv4 transport. This is the recommended approach for supporting both protocols natively.

By default, the stack retains the MAC address of the original active switch for a period defined by the stack MAC persistence timer (default 4 minutes). If the failover occurs and the timer has not expired, the new active switch continues using the same stack MAC address, minimizing disruption to neighboring devices and avoiding MAC address table changes.

This is the correct QoS architecture. In a leaf-spine fabric, the leaf switch is the first device to see server-originated traffic, so it must be the trust boundary: classify and mark traffic (e.g., iSCSI as EF or AF4x, backup as AF11) at ingress, using ACLs, class-maps, and policy-maps. Then apply egress queuing policies on both leaf and spine egress interfaces: spines handle inter-leaf traffic and need the same scheduling (strict priority, bandwidth allocation, WRED) based on the already-marked DSCP values, while leaf egress interfaces handle traffic toward servers (including storage targets). Marking at ingress and consistent queuing at every egress hop preserves the PHB (Per-Hop Behavior) across the fabric, so iSCSI latency and loss stay controlled even when backup traffic congests the network.

VXLAN is the encapsulation used to carry Layer 2 frames over Layer 3 fabric.

Phase 2 negotiation uses the transform set to define encryption and integrity algorithms for the IPsec SA. If the transform sets differ between peers, the quick mode negotiation fails even though Phase 1 succeeded. Matching transform sets on both routers is essential to complete Phase 2 and establish the data-protection tunnel.

In Control-Plane Policing (CoPP) on Nexus switches, the police command defines separate actions for packets that conform to, exceed, or violate the configured rate. If the conform-action is set to 'drop', the policer drops every packet matching that class map, regardless of its instantaneous rate or whether it falls within the committed burst. Since the observed 5 Mbps is below the 10 Mbps police rate, the traffic is conforming; yet it is still dropped, which precisely matches a conform-action of drop rather than the common 'transmit' conform-action. This effectively turns the class into an unconditional drop filter for control-plane traffic.

EVPN acts as the control plane for VXLAN, using MP-BGP to advertise MAC and IP addresses (Type 2 and Type 5 routes) to other VTEPs. This allows each VTEP to build a forwarding table for remote hosts, eliminating the need for flooding to learn MAC addresses and enabling optimal forwarding across the Layer 3 underlay.

The vEdge must first connect to the vBond orchestrator to learn about vSmart and vManage. The vBond IP address must be correctly configured, and UDP port 12346 must be open for the DTLS control connection. If the vEdge cannot reach vBond, it will not obtain the vSmart information and cannot establish control connections. This is the first step in troubleshooting.

RESTCONF on Cisco IOS XE requires HTTP authentication. A 401 Unauthorized indicates missing or invalid credentials. Creating a local user with sufficient privilege and including the credentials in the Authorization header (Basic Auth) allows the request to be authenticated. This is the standard method for RESTCONF access when no AAA server is configured.

In DMVPN Phase 3, the hub sends NHRP redirect messages telling a spoke that a superior direct path to another spoke exists. The spoke then resolves the target's NBMA address and builds a direct tunnel, bypassing the hub.

VXLAN tunnels Layer 2 over Layer 3.

To assign an IP address for management on a Cisco switch, you create an SVI for the management VLAN and assign the IP address under that interface. This is the correct method because it allows the switch to be reachable on VLAN 10. The command sequence is entered in global configuration mode: interface vlan 10, then ip address 10.10.10.2 255.255.255.0. This enables SSH management when combined with proper default gateway and SSH configuration.

CoPP (Control Plane Policing) uses an MQC policy with policers to rate-limit traffic destined to the switch CPU. A monitoring server’s ICMP packets (e.g., ping to the management IP) are classified into a class that matches ICMP; if the configured police rate (e.g., committed information rate) is too low, packets exceeding the burst are immediately dropped. The drop counters in 'show policy-map control-plane' confirm that the traffic was admitted to the control plane but then policed, not blocked earlier.

This is the correct answer. The MPLS LDP binding output lists exactly three remote label bindings, each originating from a different LSR: 10.9.9.1:0, 10.9.9.2:0, and 10.9.9.3:0. These are remote because they are label bindings learned from peer LSRs via LDP, as opposed to the local binding the router itself advertises. The count of three remote entries directly answers the question, so option 3 is correct.

Loopback0's IP address becomes the source address in the telemetry packet headers, ensuring the gRPC receiver sees a stable, routable source rather than a transient physical interface address. This satisfies the need for deterministic telemetry source identification.

CoPP operates by attaching a service policy to the control-plane interface (control-plane global configuration), which only sees traffic punted to the route processor. Matching ICMP echo requests destined to the router's own addresses in a class map, then applying the policy to control-plane, rate-limits only router-bound ICMP while transit traffic is untouched. This is the standard CoPP design pattern for protecting the route processor.

DHCP snooping's default trust model marks every switch port untrusted, so DHCP server replies arriving on access ports are dropped; only uplinks or server-facing ports are explicitly trusted. This satisfies the stem's requirement for a true statement about DHCP snooping.

The `flags: static` and `timeout: never` fields confirm permanent one-to-one mappings, so these entries persist indefinitely rather than expiring like dynamic NAT translations. Because no outside local or global addresses appear, the entries are simple static mappings awaiting traffic. They remain until the engineer manually clears them with `clear ip nat translation`.

LISP (Locator/ID Separation Protocol) is used in Cisco SD-Access for endpoint location mapping. Fabric edge nodes register endpoint EIDs with the control plane node, which maintains a mapping of EIDs to RLOCs. This allows the fabric to route traffic based on endpoint identity. LISP is the correct protocol for this function.

This sequence correctly enables OSPFv2 SHA-256 HMAC authentication. The interface command ip ospf authentication key-chain references a key chain, which must be defined globally with a key that specifies the cryptographic algorithm hmac-sha-256 and a password. This provides stronger security than MD5. The key chain allows for key rollover and multiple keys with different lifetimes, which is essential for operational flexibility.

A single policer applied to a class that matches BGP, SSH, and SNMP treats all three protocols identically. During high CPU, BGP keepalives may exceed the 1000 pps rate along with other traffic, causing drops. BGP requires a separate class with a higher rate or priority to ensure keepalives are not dropped. The design flaw is the lack of granularity.

Correct. A single EtherChannel supports up to eight active member links in Cisco IOS and IOS-XE implementations. This limit applies to the actual forwarding links, regardless of whether the channel is formed statically, with PAgP, or with LACP. While some platforms extend the total to 16 by adding standby links via LACP, only eight can be actively forwarding at any given time.

Correct. Without DHCP or a static IP-source binding, IPSG blocks the traffic.

IPsec anti-replay protection relies on monotonically increasing sequence numbers and a receiver-side sliding window, typically 64 packets wide. If traffic is load-balanced across multiple paths with different latency, packets can arrive out of order; a legitimate packet whose sequence number falls below the left edge of the window is treated as a replay and discarded. This is a well-known cause of intermittent IPsec drops, especially with unequal-cost multipath or ECMP routing.

UDP jitter is a connectionless probe that depends on the remote router actively running the IP SLA responder service. The responder listens on a designated UDP port, timestamps each received packet, and echoes it back to the source so that one-way delay and jitter can be computed. Without this responder, there is no process bound to the destination port, so the probe packets are dropped or answered with an ICMP port unreachable rather than a valid IP SLA response.

SSH encrypts CLI sessions, SNMPv3 with authPriv provides both authentication and encryption for SNMP, and TACACS+ centralizes administrator authentication with per-command authorization. This combination meets the requirement to encrypt all management traffic and authenticate against a central server. It is the standard secure management baseline for Cisco IOS XE devices.

VXLAN tunnels use a loopback interface as the source to ensure high availability and stability. A /32 loopback is always up and not tied to a physical port, so the tunnel source remains reachable even if a link fails. This is the recommended design for VTEPs in a VXLAN EVPN fabric.

Cisco's BGP best-path algorithm evaluates weight first; the highest weight always wins. Since the current best path has a higher weight, it remains selected regardless of local preference, because local preference is only compared after weights are found equal. Thus a higher local preference cannot make a lower-weight route the best path.

Indexing the JSON object by key retrieves the nested value directly: `response['response']` yields the list, `[0]` selects its single dictionary element, and `['overallHealth']` returns `"good"`. This satisfies the stem's requirement to extract the health status from the parsed API response without iterating.

Ansible is an agentless automation tool that uses YAML-based playbooks to define tasks. It connects to network devices via SSH or other protocols without requiring any software installation on the managed devices. This matches the engineer's requirements: simple, agentless, and YAML-based configuration management for Cisco IOS XE switches.

Ansible is an agentless automation tool that uses YAML-based playbooks to define tasks. It connects to managed devices over SSH or NETCONF, so no agent software needs to be installed on the Cisco IOS devices. This makes it ideal for simple, push-based configuration management. Ansible modules like 'ios_config' allow network engineers to automate configuration changes across multiple devices efficiently.

In Cisco SD-Access, LISP (Locator/ID Separation Protocol) serves as the control plane protocol that separates endpoint identity (EID) from its location (RLOC). It maintains a mapping database that allows fabric edge nodes to query the mapping system to locate endpoints. This enables scalable, dynamic endpoint mobility and policy enforcement across the fabric.

The default EIGRP hello interval on point-to-point serial links is 5 seconds. This design ensures fast neighbor discovery and rapid convergence since EIGRP relies on periodic hello packets (multicast to 224.0.0.10) to maintain adjacency. The corresponding hold time defaults to 15 seconds (three times the hello interval), allowing only one missed hello before the neighbor is declared down. This 5-second default also applies to Ethernet and most high-speed media, making it the standard EIGRP hello interval.

This is correct because an SVI provides Layer 3 processing for a VLAN, and enabling IP routing on the stack allows inter-VLAN traffic to be routed internally. The stack acts as a single logical switch, so SVIs are active on the stack master and traffic between VLANs is routed without an external router.

vSmart controller is the central control plane component that runs the Overlay Management Protocol (OMP) to advertise routes and policies to all vEdge and cEdge devices. It learns reachability information from edge routers, applies centralized policies, and then computes and distributes the necessary forwarding state to maintain an optimized overlay. This makes vSmart the authoritative source for route and policy information, hence the correct answer.

The configuration shows 'service-policy input' on GigabitEthernet0/0.900, which places the QoS policy in the inbound direction for that subinterface. The policy-map contains class-maps for voice (DSCP EF) and data (DSCP AF31), each with a 'police' command that applies token-bucket rate limiting. Therefore, the correct interpretation is that inbound traffic on this subinterface is classified and policed for both voice and data types.

The correct cause is that the hub's loopback0 network is not being advertised to the spokes by the dynamic routing protocol (such as EIGRP or OSPF) running over the DMVPN tunnel. Even though the tunnel is up and the tunnel IP is reachable, the spokes have no routing entry for the loopback0 prefix, so packets destined to that loopback are dropped or sent toward some default route. The fix is to include loopback0 in the routing protocol's network statements and ensure it is advertised through the tunnel, not just the tunnel interface itself.

The 'tx' keyword in the monitor session command restricts copying to egress traffic only, meaning frames that the source interface GigabitEthernet1/0/6 transmits out of itself. The switch captures those frames and forwards a copy out of the destination interface GigabitEthernet1/0/7, which is configured as a SPAN destination. No ingress frames received on the source are considered, so the description is accurate.

<get-config> is the NETCONF operation used to retrieve configuration data. It requires a <source> element specifying the configuration datastore (e.g., <running>) and can include a <filter> to limit the data returned. This is the correct way to retrieve a subset of the running configuration, such as interface configuration.

The presence of the 'overload' keyword in the NAT configuration, combined with an access list that matches the entire 192.168.1.0/24 subnet, causes the router to perform Port Address Translation. Every inside host sharing the single public IPv4 address 203.0.113.1 is differentiated by a unique TCP/UDP port number, while the configuration does not reserve any pool of public addresses. This is the expected behavior for many-to-one internet access.

Running network functions as software on commodity x86 servers removes reliance on costly proprietary appliances, directly lowering capital expenditure. This cost-reduction mechanism is exactly the NFV benefit the stem asks you to identify as true.

The fabric border node is responsible for bridging the SD-Access fabric to external networks. It translates fabric VXLAN encapsulation to traditional networking protocols and vice versa, allowing endpoints inside the fabric to reach destinations outside. It also advertises fabric prefixes to external networks. This is the primary role of a border node in Cisco SD-Access.

Overlay Management Protocol (OMP) is the control plane protocol used in Cisco SD-WAN. It runs between vSmart controllers and vEdge routers to distribute routing, policy, and service information securely. OMP uses TLS for encryption and authentication, ensuring secure communication. It is the correct protocol for this requirement.

The 'crypto ipsec security-association lifetime seconds 3600' command sets the IPsec SA lifetime to 3600 seconds, after which the SA is rekeyed. This is the correct command to control the rekey interval for the IPsec (data) tunnel. The IKE SA lifetime is controlled separately with 'crypto isakmp policy' or 'crypto ikev2 policy' settings, but the IPsec SA lifetime is what governs data tunnel rekeying.

The 'interface nve 1' command creates a Network Virtualization Edge (NVE) interface, which is the logical interface used for VXLAN tunneling. Under this interface, you configure the source-interface and member VNIs. This is the standard way to enable VTEP functionality on Cisco platforms.

In a VXLAN fabric, a distributed anycast gateway uses the same virtual IP and virtual MAC for the default gateway on every edge node that hosts the subnet. A roaming host sees no change in gateway identity, so ARP entries remain valid. This provides seamless mobility and optimal forwarding without tromboning traffic to a central gateway.

This is correct because enabling unicast routing on a bridge domain, combined with the hardware proxy function, allows the leaf switches to perform distributed gateway routing for endpoints in that bridge domain. The anycast gateway is programmed on every leaf, so traffic is routed at the ingress leaf without tromboning to a central spine, meeting the distributed routing requirement.

Access-list 101 is referenced by the crypto map's 'match address 101' statement, which defines the interesting traffic that will be protected by IPsec. The ACL explicitly permits traffic from source network 192.168.10.0/24 to destination network 192.168.20.0/24, so only that traffic triggers the establishment of the IPsec security association. This is correct because without a matching ACL entry, no traffic would be encrypted and the VPN would not carry any payload.

The configuration is complete because the 'router ospf <pid> vrf GREEN' command correctly creates an OSPF process bound to VRF GREEN, and the 'network' statement uses a wildcard mask to advertise the appropriate subnet into OSPF. The router-id is automatically selected from the highest loopback or active interface address in the VRF, so no explicit router-id is required. Thus, OSPF will operate correctly within the VRF.

In LLQ, the priority queue is serviced first and can starve other queues if not policed. Configuring policing on the voice class limits the amount of traffic that can enter the priority queue, ensuring that other queues get bandwidth. This is the standard method to prevent starvation in LLQ deployments.

The ncclient library implements the NETCONF protocol over SSH, opening a session on port 830 and exchanging XML-encoded RPCs. It retrieves configuration and state data modelled by YANG, satisfying the stem's requirement for programmatic IOS-XE interaction via NETCONF rather than RESTCONF's HTTP-based interface.

The vEdge router is responsible for data plane forwarding and application identification. It uses deep packet inspection (DPI) or Cisco NBAR to classify traffic into applications, which is essential for application-aware routing policies. This classification allows the router to make informed path selection decisions based on application performance requirements.

The statement is correct because the AP profile sets the country code to the United States, forcing the access point to comply with the FCC regulatory domain. That country code dictates which 2.4 GHz channels are valid (typically 1–11 rather than 12–14), which 5 GHz channels are available, including DFS restrictions, and the maximum allowable transmit power (EIRP) per channel. Setting the wrong country code can cause illegal transmissions or harmful interference, so the country code is a mandatory, compliance-relevant field within the AP profile.