ENCOR 350-401 (350-401) — Questions 676–750

In IKEv2, the profile must specify the trustpoint that contains the router's identity certificate and the CA certificate for verifying peer certificates. If the trustpoint is not referenced or is incorrect, the router cannot validate client certificates, leading to authentication failure. This is a common misconfiguration when setting up certificate-based IKEv2. The logs indicating certificate authentication failed point to a trustpoint or PKI issue.

This option is correct because the command `aaa authentication login default local` applies local authentication to every login attempt, regardless of transport (console, VTY, or auxiliary). Additionally, `aaa authorization exec default local` defers authorization decisions to the local database, but that is not contradicted here. The final command, `aaa accounting exec default start-stop group tacacs+`, instructs the device to generate start and stop accounting records for each EXEC session and forward them to the TACACS+ server. Thus, authentication is local, while accounting is sent remotely to TACACS+.

Fabric edge nodes are responsible for VXLAN encapsulation and decapsulation at the fabric boundary. They provide the anycast gateway, which serves as the default gateway for endpoints, allowing seamless mobility. This statement correctly describes a key role of edge nodes in SD-Access, making it one of the accurate statements.

VXLAN encapsulates Layer 2 frames into UDP packets. The standard destination UDP port is 4789, as assigned by IANA. This encapsulation allows Layer 2 segments to be stretched over a Layer 3 network. The source port is dynamically chosen to provide entropy for ECMP hashing.

This command configures AAA authentication for login using TACACS+ first, then falls back to the local database if the TACACS+ server is unreachable. The 'local' keyword ensures that local authentication is attempted only if the TACACS+ servers do not respond, providing a failover mechanism for management access.

The traceroute command sends packets with incrementally increasing Time-to-Live (TTL) values and records the ICMP Time Exceeded messages returned by each hop. This provides a list of routers along the path and round-trip time for each hop. It is the standard tool for path discovery and latency measurement on Cisco IOS XE.

The ietf-interfaces YANG model separates configuration data under 'interfaces' from operational state under 'interfaces-state'. Statistics are operational, so requesting them beneath 'interfaces' targets a non-existent node, producing the 404 despite the interface existing and being operational.

The police rate of 1 Mbps is insufficient for the aggregated SSH (TCP/22) and SNMP (UDP/161) control-plane traffic generated by the management station. Under CoPP, the policer uses a token bucket that drops packets exceeding the committed information rate, and if the peak management traffic exceeds 1 Mbps, legitimate packets will be dropped, causing timeouts or loss of management access. The correct remedy is to raise the police rate above the expected combined throughput, not to change the classification or action.

RSPAN (Remote Switched Port Analyzer) is designed to forward mirrored traffic from a source switch across a network to a destination switch where an analyzer is attached. To achieve this, it defines a dedicated RSPAN VLAN that serves as a transport backbone: the source SPAN session copies frames into the RSPAN VLAN, and the destination SPAN session extracts those frames to a local monitor port. This VLAN must be allowed on all trunk links between the source and destination switches and should be used exclusively for mirrored traffic to prevent interference with production data.

This configuration enables OSPF on the router, advertises the internal subnet, and sets all interfaces to passive by default. The 'no passive-interface GigabitEthernet0/0' command re-enables OSPF hello processing only on the internal interface, allowing adjacencies to form there while suppressing them on the DMZ and Internet interfaces. This matches the requirement exactly.

The counters confirm both flow outcomes: for SGT 10 to SGT 20, the deny counter is zero while the permit counter has incremented, so that traffic is being permitted; for SGT 10 to SGT 30, the deny counter has incremented 500 times, proving that traffic is being denied. This is the only interpretation that is consistent with both observed counter values and explains the full policy behavior.

ISE can return an SGT in the authorization result based on Active Directory group membership, and the access switch applies it to the session. To carry the tag to downstream devices, either inline tagging on the link or SXP propagation must be configured, enabling enforcement of group-based policy across the network.

vSmart controllers form the control plane of Cisco SD-WAN. They run the Overlay Management Protocol (OMP) to distribute routing, policy, and key information to vEdge routers, establishing a secure and scalable overlay. They maintain the control plane relationships and enforce centralized policies, separating control from data plane.

The 'ip flow ingress' command enables NetFlow accounting for ingress traffic on the interface. It is the correct command to start capturing flow data for incoming packets. This is a fundamental step in configuring NetFlow on a Cisco IOS router, and it must be applied to the interface that will be monitored.

The VNI must be explicitly activated under BGP EVPN. Without the 'vni 10100 l2' configuration inside address-family l2vpn evpn, BGP has no awareness of this L2 VNI and will not originate or import the type-2 (MAC/IP) and type-3 (inclusive multicast) routes needed for remote VTEPs to learn MAC addresses. Adding that command, along with 'evpn' as the address family, is what makes the control plane advertise the VNI. This is the missing configuration causing the issue.

Since the phone does not support MACsec, link-layer encryption cannot be established. The engineer must either upgrade to a MACsec-capable phone or use a higher-layer encryption method like IPsec, which can encrypt traffic end-to-end regardless of link-layer capabilities. This is the only viable way to secure the traffic.

Cisco DNA Center Assurance provides detailed client health metrics beyond the overall health score. By drilling down into a specific client's details, you can view RSSI, SNR, retry rates, and other RF parameters that may indicate poor performance despite an overall 'Good' status. This granular data helps identify the root cause of the issue.

The MQC policy-map action `set ip precedence 5` explicitly writes the 3-bit IP precedence value in the Type of Service byte. Precedence 5 is the standard value associated with the EF PHB (DSCP 46), so this command satisfies the marking requirement directly. In Cisco IOS/IOS-XE, this is the correct method when the requirement is specifically to mark IP precedence, and attaching the policy map to the interface (or globally) makes the classification and marking take effect.

gRPC is a valid transport for model-driven telemetry on Cisco IOS-XE, carrying dial-out subscriptions over HTTP/2 with protobuf-encoded data. It satisfies the stem's receiver requirement, unlike NETCONF or RESTCONF, which are configuration and retrieval protocols rather than telemetry transports.

BPDU Guard is the correct choice because it actively shuts down the port by placing it into an errdisable state whenever any BPDU is received on an access port. Since access ports should never receive BPDUs from an end host, a received BPDU indicates an unauthorized switch attempting to participate in spanning tree, and BPDU Guard immediately blocks that port to preserve the intended STP topology and prevent potential loops.

Assurance Health Rules (also known as Health Rules) in Cisco DNA Center allow administrators to define custom thresholds and conditions for various health metrics, including onboarding time. By configuring a health rule, the administrator can specify a threshold and have Cisco DNA Center generate an alert when that threshold is exceeded. This is the correct feature for proactive, threshold-based alerting.

The hosts cannot reach the SVI because their default gateway is either absent or set to an incorrect IP address. For inter-VLAN communication, each host must send Layer 3 packets to its VLAN's SVI IP, which then routes them to other VLANs. If the gateway points to the wrong address (e.g., another host or a nonexistent IP), frames are sent to the wrong destination and never reach the distribution switch's routing engine.

Under the NVE interface, source-interface loopback0 sets the VTEP IP address, and host-reachability protocol bgp enables BGP EVPN for remote VTEP and MAC learning. This combination is essential for a functioning VTEP in an EVPN fabric. Without the source-interface, the NVE would not know which IP to use for tunnels, and without host-reachability, it would rely on data-plane learning.

The VNFM handles lifecycle operations for virtual network functions, covering instantiation, scaling, updating and termination, as ETSI MANO defines. This satisfies the stem's requirement for a true MANO statement, since lifecycle management of VNF instances falls squarely within the VNFM's orchestration role rather than the NFVO or VIM.

The output explicitly shows two PIM neighbors within VRF CUSTOMER-F, and the role column designates 10.0.3.2 as DR and 10.0.4.2 as BDR, confirming that PIM is enabled and operating normally on this VRF. The DR/BDR election is functional, which verifies the multicast routing control plane is active. This matches the expected behavior for a properly configured VRF with PIM.

EPC uses an access list to filter captured traffic. The access list 'permit tcp any eq 80 host 10.1.1.1' matches TCP packets with source port 80 and destination IP 10.1.1.1. This access list is then applied to the capture point using the 'access-list' keyword. This is the correct method to filter specific traffic in EPC, as it leverages standard ACL syntax to define match criteria.

MP-BGP EVPN is a control plane protocol that allows VTEPs to exchange MAC address and IP address reachability information. It provides a scalable way to dynamically learn remote VTEP mappings, eliminating the need for flood-and-learn. In a VXLAN EVPN setup, MP-BGP EVPN is used to distribute MAC/IP bindings, enabling efficient and scalable overlay networks. This is the correct protocol for dynamic learning.

IP SLA operations can be tied to Cisco tracking objects using the 'track' command, where the tracked object state changes based on probe reachability or response-time thresholds. When the probe fails consecutive times, the tracking object transitions to 'down', which can trigger a floating static route, policy-based routing, or other route manipulation to redirect traffic. This creates a dynamic failover or convergence mechanism driven by synthetic traffic rather than solely by physical link state.

The Trends feature in Assurance plots historical telemetry, letting the engineer chart the access switch's CPU utilisation over time and correlate the spike with its root cause, which the real-time health dashboard alone cannot show.

On Cisco Nexus switches, NetFlow is configured using flow exporters, flow records, and flow monitors. The flow exporter defines the collector's IP address and UDP port. The flow monitor references the exporter and record, and is applied to an interface. This enables the export of flow data to the specified collector.

Receivers must explicitly send PIM joins toward the rendezvous point to be added to the distribution tree; traffic is only delivered where requested. This explicit join model is the defining mechanism of sparse mode, contrasting with dense mode's flood-and-prune approach.

In SD-Access, the LISP map server and map resolver track endpoint identifier to routing locator mappings. Fabric edge nodes register local endpoints and query the map server for remote ones, which provides a control-plane lookup instead of data-plane flooding. This is how the fabric scales to thousands of endpoints while avoiding broadcast or unknown unicast flooding across the underlay.

The view command 'iso included' in Cisco IOS SNMP configuration includes the entire ISO OID subtree (1.3.6.1), which covers all MIB objects accessible via SNMP. For a write view intended to be restricted, this is overly permissive because it grants write access to virtually any managed object, including critical system parameters. This defeats the purpose of VACM (View-Based Access Control Model) restriction, making it a security flaw. Hence, the configuration should use a more specific subtree, such as 'system' or 'interfaces', to limit the write scope.

BPDU Guard is designed to protect access ports from receiving BPDUs. When a BPDU is detected on a port with BPDU Guard enabled, the switch immediately places that port into err-disabled state, preventing the unauthorized device from participating in spanning tree and potentially causing loops or topology changes.

Setting the switch's spanning-tree priority to 61440 (the highest numerical value) ensures its bridge ID will never be preferred over a legitimate root, because the root election down-selects the lowest bridge priority. Since Rapid PVST+ (802.1w) is already active, link failures are recovered through explicit proposal/agreement handshakes, eliminating the need for any extra convergence mechanism. This is the recommended way to pin the root on a distribution switch while making access switches incapable of becoming root even after a topology change.

VRF instances are isolated by default. By assigning interfaces to the guest VRF, traffic within that VRF is separate from the corporate VRF. As long as no route leaking (such as static routes or BGP route targets) is configured, the VRFs remain isolated. This is the correct and sufficient step to maintain isolation.

This is the best practice. By creating separate classes, the engineer can apply different rate limits. Management traffic should have a higher rate limit to ensure administrators can always access the device, while control plane protocols can have lower limits to protect the route processor. This granularity ensures that critical management access is not starved during an attack, and routing protocols are still protected but not at the expense of management access.

On a point-to-point OSPF network type, Cisco's default hello interval is 10 seconds, identical to the default on broadcast networks. This is because both network types use the same timer defaults on Cisco IOS, and the dead interval is then calculated as 4 × 10 = 40 seconds. Since the option specifically addresses the hello interval, it is correct.

Application-Aware Routing (AAR) in Cisco SD-WAN uses real-time performance metrics such as latency, jitter, and packet loss to select the best path for specific applications. It can direct traffic based on SLA policies, ensuring critical SaaS applications get prioritized treatment. This feature meets the requirement by dynamically choosing the optimal path and enforcing QoS. Therefore, it is the correct answer.

Root Guard is a protection mechanism enabled on designated ports of a switch that should remain the root bridge. If such a port receives a BPDU from another switch that advertises a lower bridge ID or better root path cost, that BPDU is 'superior' and would normally cause the local switch to surrender root status. Rather than accept it, Root Guard places the port into a root-inconsistent (blocking) state — often referred to as error-disabling the port — so the intended root remains authoritative. The port does not pass traffic until the invalid BPDUs stop and the STP topology stabilizes.

A standard vSwitch is a software Layer 2 bridge inside one hypervisor, forwarding Ethernet frames between VMs on that same host using MAC learning. It satisfies the scenario's on-host switching constraint, since traffic between local VMs never leaves the physical host.

This is correct because the route-map 'bgp' is applied inbound from neighbor 10.0.0.2, and it sets the community 100:200 on all received routes. However, BGP does not include community attributes in updates to other peers unless the neighbor is explicitly configured with the send-community parameter. Without send-community, the routes are advertised but the community attribute is stripped, so it never propagates beyond the local router.

NetFlow (IP traffic export) samples and exports flow records containing source/destination IP addresses, Layer 4 ports, protocol numbers, and packet/byte counts to a NetFlow collector. By analyzing these exported records, the administrator can pinpoint exactly which flows are contributing to the saturated 'IP Input' process, such as specific hosts generating large volumes of routed traffic. This local, low-overhead mechanism is specifically designed for flow-level visibility and is the correct tool for this troubleshooting scenario.

The ingress LSR classifies the incoming IP packet, assigns the appropriate forwarding equivalence class, and pushes the corresponding label onto the packet before forwarding it into the MPLS domain. This imposition step satisfies the stem's ingress label-operation statement.

The Flexible NetFlow configuration defines a custom record using match statements for source IP, destination IP, and protocol, along with collect statements for byte and packet counts. The monitor is attached to the interface with the 'input' keyword, which restricts capture to ingress traffic only. This is the standard way to monitor incoming flows without affecting outbound traffic, and the collected fields directly match the description.

An IKE Phase 1 lifetime that is set too low forces frequent ISAKMP SA renegotiations. If the new Phase 1 exchange cannot complete before the current Phase 1 SA expires, the existing IPsec SAs are invalidated and traffic is dropped while new tunnels are built. Even when rekeys do complete, the short lifetime increases the overlap and timing mismatch with the Phase 2 IPsec lifetime, making drops more likely during transitions. This is the correct cause because it directly matches the symptom of recurring connectivity interruptions.

Centralized data policy in Cisco SD-WAN allows you to define traffic steering based on application, source/destination, and transport. You can create a policy that matches ERP traffic and directs it exclusively to the MPLS transport, while matching guest traffic and directing it to the Internet. This enforces the required path selection.

This route-map is applied to BGP routes before they are sent to the peer, and it explicitly uses a set command that assigns the Multi-Exit Discriminator (MED) value of 50 to all advertised routes. MED is a non-transitive BGP attribute that influences the peer's inbound path selection, with a lower value preferred over a higher one. Therefore, the statement is correct: the MED of routes advertised to 10.1.1.1 is set to 50.

This sequence enables AAA with 'aaa new-model', configures the ISE RADIUS server with the correct ports and key, then on the interface enables 802.1X port-based authentication with 'authentication port-control auto' and designates the switch port as an authenticator with 'dot1x pae authenticator'. This is the correct method to authenticate before granting access and to use an auth-fail VLAN if configured.

In Cisco TrustSec, the access layer device, such as a Catalyst switch or wireless controller, is responsible for classifying and tagging packets with an SGT after the endpoint is authenticated. This tagging enables enforcement throughout the network based on the Security Group Tag, allowing dynamic segmentation as users move between wired and wireless access points.

The 'unknown-element' error occurs when the filter references a data node that is not defined in any YANG model supported by the device or when the namespace is incorrect. The engineer must confirm that the device supports the ietf-interfaces or Cisco-specific interface YANG model and that the filter uses the exact namespace and node names from that model.

The absence of 'aaa authentication enable default' leaves the default behavior of no authentication for enable mode, allowing any user to switch to privileged EXEC without a password. Once in enable mode, the user is at privilege level 15, and if command authorization is configured for level 15, the device may not trigger an authorization check because the user already holds full privilege, or the check may occur but without prior authentication it is ineffective. This configuration flaw directly explains why no credentials are prompted and why authorization seems bypassed.

Zone-Based Firewall uses zone pairs to define directional policy. Creating a zone pair from inside to outside with an inspect action permits inside-initiated sessions and automatically allows return traffic. Because there is no zone pair from outside to inside, traffic initiated from the outside zone to the inside zone is denied by default, which matches the requirement exactly.

The vManage REST API uses session-based authentication where the client posts credentials to /j_security_check and receives a JSESSIONID cookie. This cookie must be included in subsequent API requests. This is the standard method for programmatic access to vManage, allowing scripts to authenticate and perform operations.

The ACL on Gi0/0 contains two permit statements matching ICMPv6 echo-request (type 128) and echo-reply (type 129), followed by an explicit deny statement for all other IPv6 traffic. Because the ACL is applied inbound with the 'in' keyword, only packets entering the interface that match these two permit statements are forwarded; any other IPv6 packet is dropped. This is a common security practice to allow ping while blocking other ICMPv6 control messages.

The port's 'bndl' state in the EtherChannel summary indicates it is successfully bundled into the channel, and the LACP state value 0x3D signifies that the port is synchronized with its peer. This full operational state means the port is actively forwarding traffic as part of the EtherChannel.

In NetFlow v9/IPFIX, template records define the data record format and must be present on the collector before any data can be decoded. The 'template data timeout' command sets the refresh interval, so a template FlowSet is re-sent to the collector every 60 seconds regardless of whether new data flows have been observed. This periodic refresh keeps the collector's template cache synchronized and avoids relying on the timing of new flows.

Path Trace in Cisco DNA Center Assurance visually traces the path of a client's traffic through the network, showing each hop and any drops. It can simulate DHCP requests and responses, highlighting where packets are discarded. This directly addresses the need to identify where DHCP packets are being dropped for the client, making it the correct tool.

The ios_config module pushes the listed configuration lines verbatim to the device, so 'snmp-server community public RO' creates community string 'public' with read-only access. Because gather_facts is disabled, no fact collection interferes; the task simply applies the SNMP community as specified.

VRF creates multiple independent Layer 3 routing and forwarding tables on a single physical device, so each tenant gets its own RIB/FIB and can run a separate routing protocol instance. This directly satisfies the requirement of isolated routing tables plus independent protocol instances sharing the same physical uplinks and hardware.

RADIUS merges authentication and authorization into one Access-Accept packet, returning attributes such as service type and IP assignment together. TACACS+ separates these functions, issuing distinct authentication and authorization exchanges. This combined-packet behaviour is the specific RADIUS trait being verified.

AS_PATH prepending artificially lengthens the AS path by adding multiple copies of the enterprise's ASN (65000) to the prefix advertised to ISP2. Because ISP2's BGP best-path algorithm compares AS_PATH length among equal-preference routes, the path through R2 appears longer than the same prefix advertised via ISP1's shorter AS path. This induces ISP2 to select the ISP1 route for inbound traffic, thereby directing traffic to R1 as intended. It is a standard, lightweight technique that only changes how ISPs view the return path, without affecting outbound routing.

CoPP policies that apply a blanket rate limit to all control plane traffic can inadvertently throttle essential routing protocol messages like BGP keepalives and updates. If the rate limit is too low or not exempting BGP, sessions may flap due to missed keepalives or delayed updates. The policy must be fine-tuned to allow sufficient bandwidth for routing protocols.

A Type 1 hypervisor runs directly on the server's hardware with no underlying OS, giving it exclusive control of the CPU, memory, and I/O devices. Through VT-d/IOMMU, it can map a physical PCIe function to a single VM, enabling device passthrough that delivers near-native throughput for NICs and GPUs. Examples like VMware ESXi and KVM (via Linux's kernel modules) are purpose-built for this role, which is why they are the correct answer.