ENCOR 350-401 (350-401) — Questions 751–825

Cisco DNA Center Assurance integrates with Cisco ISE to pull client authentication and authorization information. This integration allows Assurance to show detailed client onboarding and policy compliance data. By correlating network and identity data, engineers can troubleshoot issues related to authentication and access. This is a valid and important capability.

SLAAC allows hosts to automatically generate their own IPv6 addresses using the network prefix from Router Advertisement messages and their interface identifier (often derived from the MAC address via EUI-64). No DHCPv6 server is needed, satisfying the requirement. The router sends RA messages with the A flag set to 1, instructing hosts to use stateless autoconfiguration. This method is ideal for simple deployments where centralized address management is not required.

CoPP is implemented by attaching a policy-map to the control-plane interface using the service-policy command under the control-plane global configuration mode. This causes the policy to inspect only packets that are punted to the route processor, thereby protecting the control plane without affecting transit traffic on physical interfaces.

The feasibility condition is EIGRP's loop-free guarantee: a neighbor advertises a reported distance (RD) that is strictly lower than the current feasible distance (FD) to a destination. This proves the neighbor's path does not pass back through the local router, so the path can safely be used as a feasible successor. If no such neighbor exists, DUAL goes active and queries neighbors, but the feasibility condition remains the core mechanism ensuring that any selected path is genuinely loop-free.

With PortFast configured on an access port, the switch port bypasses the normal Spanning Tree Protocol (STP) listening and learning states and transitions directly to forwarding, allowing endpoints such as PCs or IP phones to come up immediately. When BPDU Guard is also enabled (as is typical for access ports), the arrival of any Bridge Protocol Data Unit—which would indicate another switch has been connected—triggers an immediate error-disable of the port, preventing potential Layer 2 loops. This behavior is deterministic: forwarding first, then shutdown on any unexpected BPDU.

LLQ provides strict priority queuing for voice traffic while allowing other classes to have guaranteed bandwidth. It is configured using the priority command within a policy map applied to the interface. This meets the requirement for voice to have strict priority, video to have guaranteed bandwidth (using bandwidth command), and data to use leftover bandwidth. Therefore, LLQ is the correct queuing mechanism for this scenario.

Ansible is declarative, agentless, and connects to managed nodes over SSH without installing any agent software. Its network modules, including ios_config and ios_ospf, target Cisco IOS and IOS XE devices and push configuration from playbooks. This matches the requirement for consistency across many routers, no on-device agent, and SSH-based transport exactly as described.

HQoS uses a two-level policy map: the parent policy shapes each tenant's aggregate traffic to its contracted bandwidth (e.g., via a shape statement applied to a class that matches the tenant), while the child policy, attached to that parent class, runs CBWFQ to schedule the tenant's application classes. This nesting decouples per-tenant rate enforcement from intra-tenant scheduling, giving both bandwidth isolation between tenants and fair treatment for different applications inside each tenant. Because shaping at the parent level acts as a per-tenant token bucket, no tenant can burst beyond its allowance, and the child policy's queue weights ensure no single application monopolizes the tenant's share.

The SNMP-CLASS policer shows 40 exceeded and 10 violated packets dropped against its 16000 bps CIR, while BGP-CLASS reports zero exceeded and zero violated with all 50 packets conformed and transmitted, confirming BGP stayed within its 64000 bps rate.

Correct. DSCP is 6 bits, providing 64 possible codepoints.

The control-plane node runs LISP and hosts the map-server and map-resolver functions that store endpoint identifier-to-routing locator mappings. Edge nodes register endpoints with it and query it to resolve destinations. This directly fulfills the requirement of maintaining the mapping database that enables fabric forwarding, making it the correct role.

DHCP snooping builds a binding table of IP address, MAC address, VLAN, and interface by snooping DHCP conversations. Dynamic ARP inspection uses this table to validate ARP packets on untrusted ports. Enabling DHCP snooping on the access switches provides the required bindings automatically, minimizing manual configuration while allowing DAI to block ARP spoofing.

In Zone-Based Firewall, a policy-map that matches traffic but does not specify an explicit action such as 'inspect' or 'pass' causes the router to apply the implicit default action of 'drop'. The class-map correctly identifies the inside-to-outside traffic, but the missing action means no forwarding or stateful inspection is performed, so all matched packets are silently discarded. The fix is to configure an 'inspect' action (or 'pass' for stateless forwarding) under the policy-map for that class.

The Catalyst Center Intent API uses token-based authentication. The engineer must first authenticate by sending a POST request to the /dna/system/api/v1/auth/token endpoint with Basic Authentication (username and password). The response contains a token that must be included in subsequent API calls as an X-Auth-Token header. This is the standard method for API access.

In Cisco IOS, 802.1X authentication can succeed while accounting remains inactive because accounting is an independent AAA service. The `aaa accounting dot1x default start-stop group radius` command explicitly instructs the switch to generate start and stop records for authenticated sessions and forward them to the RADIUS server. Simply defining a RADIUS server or enabling authentication does not create accounting traffic, so without this global configuration command, the switch will never send interim or final accounting updates.

The BGP session to 10.0.0.2 is down due to a TCP connection issue. The Active state indicates that the local router is attempting to initiate a TCP connection to 10.0.0.2 but has not received a successful three-way handshake—either the remote peer is unreachable, a firewall is blocking TCP port 179, or the remote BGP process is not responding. Until the TCP session is established, BGP cannot exchange routes, which is why 0 prefixes are received and the session remains down.

YANG defines hierarchical schemas for configuration and operational state, using containers, lists and leaves to model device data. This structure underpins model-driven telemetry, where subscribed paths stream state changes, satisfying the stem's requirement that YANG models both configuration and operational data.

With `state: replaced`, the cisco.ios.ios_interfaces module treats the supplied config as the complete desired state for GigabitEthernet0/1, so any existing settings not listed — such as IP addressing, MTU or speed — are removed. Only the description and enabled state remain, satisfying the stem's requirement to strip other configuration.

The command 'netconf-yang' enables the NETCONF subsystem on a Cisco IOS XE router. It starts the NETCONF server and allows the router to be managed via NETCONF over SSH. This command is essential for enabling programmatic access to the router's configuration and operational data using YANG models. Without this command, the router will not accept NETCONF sessions, even if SSH is configured.

MAB allows devices without an 802.1X supplicant to be authenticated by their MAC address, which ISE validates against its identity store or profiling database. This lets printers and badge readers obtain limited access through the same port configuration that serves supplicant-capable laptops. MAB is the standard fallback for non-supplicant endpoints in Cisco 802.1X deployments.

Cisco DNA Center Assurance uses streaming telemetry from fabric nodes, collected by the Network Data Platform (NDP), to compute health scores. This provides near-real-time data on underlay and overlay performance, including latency, packet loss, and fabric control plane status. The NDP aggregates and analyzes this data to generate the health score.

This is correct. APs typically use DHCP to obtain an IP address and look for DHCP option 43 to discover the WLC. Without option 43, they cannot find the WLC even if they have IP connectivity.

SSH version 2 encrypts the entire management session, including authentication credentials and command output, using strong cryptography. Enabling SSHv2 on the switch and disabling Telnet ensures that remote CLI administration is confidential and integrity-protected. This directly satisfies the requirement that all management traffic between the administrator's workstation and the switch be encrypted, making SSHv2 the correct management protocol.

OSPF hello and LSA traffic to the route processor must be permitted at a sufficient rate to maintain adjacency. Creating a class-map for OSPF and assigning a policer with an adequate CIR ensures control plane protection remains in place while allowing legitimate routing protocol traffic, which resolves the flapping caused by the default policer dropping OSPF packets.

vBond is the SD-WAN's trust anchor and the first server a vEdge router contacts. It verifies the router's certificate against a preconfigured list, performs NAT traversal, and supplies the router with the list of active vSmart and vManage controllers. Without this orchestration, a vEdge router has no secure path to join the overlay network.

IGMP snooping builds and refreshes its forwarding table only when IGMP queries are present on the VLAN to solicit membership reports from receivers. If no IGMP querier is elected on the VLAN (for example, no multicast router is enabled to send general queries and the switch's querier feature is disabled), the switch never receives periodic reports and cannot maintain the multicast group, so it floods multicast frames to every port. This is the direct cause of the flooding problem.

PFC is the correct choice because it operates on IEEE 802.1Q CoS priorities and allows a receiver to send a PAUSE frame for a specific priority, pausing only the storage class of traffic while LAN traffic on other priorities continues unimpeded. This satisfies the requirement for lossless FCoE without head-of-line blocking across the entire link.

This command configures the interface as a DHCP client, allowing it to dynamically request an IPv4 address, subnet mask, default gateway, and DNS servers from the ISP's DHCP server. It satisfies the requirement to obtain the WAN address dynamically without manual configuration, and is the standard Cisco IOS method for client-side DHCP on an interface.

The error explicitly states that the candidate datastore is not supported. Many Cisco IOS XE devices support only the running datastore for NETCONF edits, not the candidate datastore. The candidate datastore allows staging changes before committing, but if it is unsupported, the <edit-config> must target the running datastore. The script should be modified to use the running datastore instead of candidate, and the <commit> operation is unnecessary because changes take effect immediately.

Cisco NFVIS is a Linux KVM-based virtualization platform that provides the hypervisor, VM lifecycle management, and orchestration APIs needed to host multiple virtual network functions on a single branch server. It allows the engineer to deploy, monitor, and manage VNFs such as virtual routers and firewalls from a centralized interface, directly supporting the multi-VNF branch design in the scenario.

The ip flow-export destination command specifies the IP address and port of the NetFlow collector. This is required to send NetFlow data to an external collector. Without this command, the router would not know where to export the flow records, so it is essential for NetFlow export configuration.

On a NUMA (Non-Uniform Memory Access) system, each node contains local memory with low latency, while accessing memory from a remote node traverses the QPI/UPI interconnect, adding significant latency. If a VM's memory allocation exceeds the capacity of a single NUMA node, the hypervisor must back the guest's physical memory with pages from multiple nodes, forcing some accesses to be remote. This VM-to-NUMA-node mismatch directly increases memory access latency and is the correct explanation, because the symptom is memory latency, not CPU or host pressure.

Cisco IOS IPS uses signatures to inspect traffic for known attack patterns and can be configured per signature or category to produce alerts rather than drops. This supports detection and logging of malicious traffic without blocking legitimate sessions, while malformed packets can still be dropped by specific signatures or by the IPS engine itself.

The NMS must be provisioned with the router's local SNMP engine ID because SNMPv3 user-based authentication (USM) derives each user's authentication and privacy keys by hashing the passphrase together with the authoritative engine ID. Without the correct engine ID, the NMS calculates a different localized key than the router, so the HMAC validation fails and the router silently discards the request after sending it with 'noAuth' or the NMS sees an authentication failure. Even if the username, passwords, and AES settings are identical, a mismatched engine ID always breaks SNMPv3 authentication, making this the necessary corrective action.

Within the default authentication method list, group radius appears as the first method, so when a new session triggers authentication, the device forwards the credentials to the RADIUS server before considering local or any other fallback. This makes RADIUS the primary source of truth for verifying usernames and passwords for default login, which typically applies to remote VTY users. Only if RADIUS cannot be reached or the server responds with an error would the later methods be attempted.

This is correct because the switchport trunk native vlan 10 command makes VLAN 10 the untagged, management VLAN for the AP, while the switchport trunk allowed vlan 20,30 command permits tagged client traffic on those VLANs. The AP's management IP resides in VLAN 10, and SSIDs are mapped to VLAN 20 and 30 for client data, maintaining separation between management and user traffic.

Cisco DNA Center uses SNMP to discover and monitor network devices. Even if SSH is reachable and the community string is correct, SNMP must be enabled on the switch for DNA Center to poll device information such as interfaces, CPU, and topology data. Without SNMP, the device will not appear in the topology view or be monitored.

Both member ports being in the 'Active' state means they are in LACP active mode and are actively exchanging LACP data units (LACPDUs) to negotiate and maintain the aggregation. This is a key indicator that the physical links have successfully formed an operational bundle, alongside the port-channel showing 'Ag-Inuse'. Thus, this is the correct observation about the EtherChannel's operational status.

Flexible NetFlow requires a flow monitor to be applied to an interface to activate flow accounting. Without applying the monitor, no flows are tracked or exported, even if the record and exporter are correctly defined. The ingress direction is typical for capturing incoming traffic, and this step is mandatory for the feature to function.

In NFVIS, every bridge must be mapped to a unique physical interface (or a VLAN subinterface), because the Linux bridge binds to the underlying netdev. When multiple bridges are all mapped to the same untagged physical NIC, only the first bridge can claim that NIC's datapath; the others receive no traffic because there is no 802.1Q tag to demultiplex frames among them. This is the classic root cause where one VNF appears up and the other VNFs have no connectivity.

The aaa new-model command activates the AAA subsystem, after which authentication, authorisation and accounting methods can be defined and applied to lines and interfaces. Without it, the device ignores those method lists, so this command is the prerequisite for any AAA configuration.

Ansible is an agentless automation tool that uses YAML for playbooks. It connects to devices over SSH or NETCONF and does not require installing agents on managed nodes. It has modules like ios_config for Cisco IOS XE. This matches the administrator's requirements for simplicity and no agent installation.

This is the correct approach because VLAN-based SPAN with 'source vlan 10 - 20 both' copies every frame that enters or leaves any port in those VLANs, including the routed traffic that is forwarded by the SVI between VLANs. The keyword 'both' ensures that both ingress (received by the VLAN) and egress (transmitted from the VLAN) traffic are mirrored, which is exactly what is needed to observe the complete inter-VLAN communication. The destination interface Gi1/0/24 is a local analyzer port on the same switch, so no remote encapsulation is required.

This is correct because the command 'switchport trunk allowed vlan 10,20,30' explicitly restricts the trunk to carry only those three VLANs. Additionally, 'switchport trunk native vlan 999' changes the default native VLAN from 1 to 999, so any untagged frames received on this trunk are assigned to VLAN 999 and forwarded accordingly. Tagged frames for VLANs 10, 20, and 30 are forwarded normally, while untagged frames are handled as part of VLAN 999, which is the expected behavior for a configured native VLAN.

Severity 0 maps to Emergency, defined in RFC 5424 as the system being unusable — the highest-urgency condition, where the device can no longer perform its function. This satisfies the stem's requirement for a true statement about Syslog severity levels, since level 0 is the most severe classification.

Cisco DNA Center often processes site creation asynchronously. A 202 Accepted response indicates the request was accepted but not yet completed. The API typically returns a task ID in the response body. The engineer must poll the task status until it succeeds before the site is available. Sending a GET immediately can result in 404 because the site does not exist yet.

This command creates a static route to 10.1.1.0/24 via next-hop 192.168.1.1 and associates it with tracked object 1. The track object is linked to the IP SLA operation, so if the operation fails, the route is removed from the routing table. This is the correct way to tie IP SLA state to a static route.

The authentication event server dead action authorize vlan command places the port into the specified restricted VLAN when the RADIUS server becomes unreachable. This allows the connected endpoint to send limited traffic instead of the port being placed in an unauthorized state, directly satisfying the requirement of continued but restricted access during a server outage.

The route-map is applied in the outbound direction for neighbor 10.1.1.1, and the set metric command sets the BGP MED (Multi-Exit Discriminator) value to 50 for every permitted route. Because the route-map contains a permit statement without a restrictive match clause, all routes advertised to this neighbor carry MED 50. This influences the neighbor's inbound path selection, preferring lower MED values, so routes with MED 50 may be less preferred than routes with lower MED from other peers.

In Cisco ACI, an L2Out is used to extend a bridge domain to an external Layer 2 network. It is configured on a border leaf and includes an external bridged domain and an external bridged network. This allows Layer 2 connectivity between the ACI fabric and external devices, which is exactly what is needed to extend the tenant's bridge domain.

HTTP 401 Unauthorized specifically indicates that the request lacks valid authentication credentials. RESTCONF on Cisco IOS XE requires authentication, typically via HTTP Basic Authentication or token-based methods. Without proper credentials, the device rejects the request. The engineer must include an Authorization header with valid credentials to succeed.

CoPP leverages Modular QoS CLI to classify packets punted to the route processor, including IKE, SSH, and SNMP, and polices them in a dedicated control-plane host path. Because the policy is applied with 'service-policy input' under 'control-plane', it only affects traffic destined to the device itself, leaving hardware-forwarded transit traffic untouched. This matches the requirement to protect the CPU while preserving legitimate tunnel establishment.

Phase 2 permits spoke-to-spoke tunnels built directly, bypassing the hub for data forwarding. Spokes learn each other's tunnel endpoints via NHRP resolution through the hub, then establish direct GRE tunnels, satisfying the requirement that inter-spoke traffic avoids hub transit.

On Ethernet (broadcast) and point-to-point links, OSPF's default hello interval is 10 seconds, as defined in RFC 2328. This 10-second hello is also paired with a default dead interval of 40 seconds (four times the hello), allowing a neighbor to be declared down after missed hellos. This setting balances fast neighbor detection with acceptable control-plane overhead on high-bandwidth LAN segments.

IS-IS is the recommended underlay routing protocol for Cisco SD-Access fabrics. It provides fast convergence, supports ECMP, and scales well in large campus deployments. It operates independently of the LISP/VXLAN overlay, allowing the underlay to focus on IP reachability. This directly meets the requirements for fast convergence and multipathing without overlay routing, making it the correct selection.

RRM's dynamic channel assignment continuously scans RF conditions and assigns each AP the channel with least interference, avoiding manual planning. This satisfies the automatic channel-selection claim, distinguishing it from static channel plans configured per access point.

The `bandwidth remaining percent 50` command on the DATA class ensures that data packets receive 50% of the bandwidth that is left over after the strict-priority voice queue has been serviced. This is a proportional share of residual capacity, not an absolute fixed bandwidth guarantee. In a CBWFQ policy, this allows the data class to compete with other default classes using the remaining bandwidth percentage toward the total unallocated bandwidth.

Strict uRPF checks that the source address of an incoming packet is reachable via the same interface the packet arrived on, using the routing table. If the source is not reachable through that interface, the packet is dropped, which directly blocks spoofed source addresses from user subnets. This matches the requirement to validate source addresses against the routing table for the incoming interface.

LDP uses TCP port 646 as its well-known transport port for reliable exchange of label binding messages. The output's TCP connection line explicitly lists port 646 for the remote endpoint, confirming that the session is running over the standard LDP TCP port. Had it been a non-default port, the configuration would have required an explicit 'port' statement under the MPLS LDP router configuration.

Correct because SPAN is local to the switch where the source ports reside.

The command 'switchport trunk allowed vlan 10,20,30' explicitly limits the VLANs permitted on the trunk to 10, 20, and 30, effectively pruning all other VLANs from that trunk link. Additionally, 'switchport trunk native vlan 10' assigns VLAN 10 as the native VLAN, meaning frames in VLAN 10 are sent untagged across the trunk. This is a valid configuration that restricts traffic to those VLANs while making VLAN 10 the untagged native VLAN.

The vRouter must attach to a data plane interface—such as a Linux bridge or OVS bridge bound to a physical NIC—so that its OSPF packets traverse the same forwarding network as the physical router. This places the vRouter in-band, allowing multicast hello packets and database descriptors to reach the OSPF neighbor. Only then will router LSA exchange and adjacency state transitions occur properly over the intended routed network.

The access layer is the optimal trust boundary because it is the first device in the path that can inspect source identities (e.g., IP phone vs. workstation) with port-level granularity. Re-marking DSCP here ensures that packets enter the network with a consistent QoS class, allowing all downstream switches to rely on these markings for queuing and policing. This prevents untrusted end devices from dictating their own priority, which is essential for converged networks carrying voice, video, and data.

NETCONF over SSH provides secure, authenticated access with structured XML payloads defined by YANG models. The <get-config> RPC retrieves the running configuration in a machine-readable format, eliminating screen-scraping. ncclient is a standard Python library for NETCONF, and individual credentials are supported. This directly satisfies all stated requirements.

Cisco DNA Center's Intent API requires a POST request to the /dna/system/api/v1/auth/token endpoint, using Basic authentication with the username and password. The response contains a token that must be included in subsequent requests in the X-Auth-Token header. This is the standard authentication flow for the Intent API.

This is the correct CoPP configuration: `class-map match-all SSH` with `match protocol ssh` classifies SSH control-plane traffic, and the policy map `COPP` applies a police rate of 1,000,000 bps with a burst of 2000 bytes, dropping exceeding traffic. The `class-default` then polices all other control-plane traffic at 8000 bps, ensuring that no unclassified protocol can flood the CPU. The syntax and parameters are correctly ordered (rate in bps, burst in bytes), providing comprehensive control-plane protection.

Correct because the RPF check compares the source IP address of the multicast packet against the routing table (RIB or MRIB) to find the outgoing interface toward the source; the packet is accepted only if it arrives on that interface.

A 429 response signals rate limiting, not a malformed payload. Retrying immediately would compound the throttling, so exponential backoff with jitter spaces retries progressively until the Meraki API's rate window resets and the PUT succeeds.