ENCOR 350-401 (350-401) — Questions 826–900

The control plane node in SD-Access runs LISP as its mapping system, maintaining the Endpoint Database (EID-to-RLOC) for every wired or wireless endpoint in the fabric. When an edge node needs to reach a destination, it sends a Map-Request to the control plane node, which replies with the routable locator (RLOC) of the destination edge node. This node is thus the authoritative source for tracking and mapping endpoint locations, making it the correct answer.

The command 'show cts role-based sgt-map' displays the IP-to-SGT mapping table, which is the exact table TrustSec policy enforcement uses. Each row binds a source IP address to a Security Group Tag, and this mapping is what the switch consults when applying SGACLs to traffic. This is the most defensible conclusion because the output is literally this table.

RADIUS accounting carries its start, stop and interim records over UDP, typically to port 1813, relying on retransmission rather than a connection-oriented session. TACACS+ instead uses TCP, so this UDP transport detail distinguishes RADIUS accounting behaviour in the stated comparison.

Port Address Translation (PAT), also known as NAT overload, is correct because it multiplexes thousands of inside hosts to a single outside IPv4 address by leveraging the transport-layer port number (TCP or UDP) to identify each unique session. The router maintains a translation table that maps (inside local address, inside local port) to (outside global address, outside global port), allowing many internal devices to share one public address simultaneously. This directly addresses the IPv4 exhaustion problem and is the standard method used in home routers and enterprise edge devices.

The correct interpretation is that a host with IP address 192.168.1.100 has joined multicast group 239.2.2.2. In the output of “show ip igmp groups” or “show ip igmp group <group>”, the “Last Reporter” field shows the IP address of the host that sent the most recent IGMP Membership Report for that group on that interface. Since the host has sent that report, the router knows to forward multicast traffic destined for 239.2.2.2 to the interface, and the host is an active receiver. This is precisely what the command output is indicating.

A Mobility Group allows multiple Cisco WLCs to share client context and coordinate roaming. When a client roams between access points on different controllers, the controllers exchange information via the mobility group, enabling seamless roaming with consistent security. This is essential for high-density environments with multiple controllers.

CoS is a Layer 2 class-of-service field carried exclusively in the 802.1Q VLAN tag, so it is only meaningful on a single Layer 2 segment. When a router receives a frame, it de-encapsulates the Layer 2 header, including the 802.1Q tag, and then forwards the packet as a Layer 3 IP packet. The CoS value is therefore lost and cannot be preserved across a routed hop; the router must explicitly map the incoming CoS value to the IP DSCP field before routing. This mapping must occur at the ingress or before the Layer 3 forwarding decision to maintain end-to-end QoS priority.

CE routers peer with PE routers at the IP layer, so any standard routing protocol works across that link: static routes, RIP, OSPF, EIGRP or BGP. The PE router then redistributes these customer routes into MP-BGP for transport across the provider backbone.

Inaccessible Authentication Bypass (IAB) allows a port to grant access when the authentication server is unreachable. It can be configured to assign the port to a critical VLAN or apply a specific policy. This matches the requirement to allow devices to connect with limited access when ISE is down.

Cisco IOS Intrusion Prevention System inspects packet payloads against signatures and can detect and drop application-layer attacks such as cross-site scripting and SQL injection. Because it examines the content of HTTP requests, it can block malicious patterns without any change to the hosted application, matching the requirement to protect the web app transparently.

Cisco Client Load Balancing distributes client devices across access points by delaying association responses when an AP is heavily loaded. This helps achieve even distribution in high-density environments. Combined with other features like 802.11k/v, it can optimize roaming, but load balancing itself is the primary feature for even client distribution, making it correct here.

The command 'spanning tree vlan 10 priority 4096' sets the bridge priority for the VLAN 10 spanning tree instance to 4096, lowering it from the default 32768. Because STP elects the root bridge using the lowest bridge ID (priority + MAC address), this significantly increases the switch's chances of winning the election for that VLAN. However, it does not guarantee the switch becomes root—any switch with a lower priority value or an equal priority but lower MAC address will still be preferred.

VRF-lite instantiates multiple independent routing and forwarding tables on one device, each running static routes or dynamic protocols such as OSPF or EIGRP. This satisfies the stem's requirement that the statement accurately describes VRF-lite's support for multiple routing instances per router.

The output displays two LDP peers with IP addresses 10.0.0.2 and 10.0.0.3. Each peer entry shows 'State: Oper', meaning the LDP sessions are operational and exchanging label bindings. Therefore, the router has two active LDP neighbors, making this statement correct.

The mls qos trust command on a switch port establishes the trust boundary, instructing the switch to accept and preserve the CoS or DSCP markings already applied by the attached device instead of reclassifying the traffic.

CoPP on IOS XE uses a modular QoS CLI structure: class maps identify control-plane traffic, a policy map defines policing actions, and the policy is attached to the control plane with service-policy under control-plane mode. Matching BGP via ACL or NBAR lets the administrator police keepalives while permitting other BGP flows, which satisfies the stated requirement.

LLQ combines class-based weighted fair queueing with a strict priority queue, allowing voice traffic to be placed in a dedicated priority queue that is served before all other queues. This guarantees that voice packets are always served first, providing low latency and eliminating drops for voice traffic even during congestion. To prevent the priority queue from starving other classes, LLQ typically applies a policer to limit the amount of traffic that can use the priority queue.

The ip helper-address command on the VLAN 10 SVI enables DHCP relay: the router intercepts the client's Layer 3 broadcast DHCPDISCOVER on interface gi0/0.10, rewrites it as a unicast packet, and forwards it to the configured server at 172.16.1.100. It also populates the giaddr (gateway IP address) field with its own interface IP (192.168.10.1), which tells the server exactly which subnet the client lies on so the correct scope is selected. The server's DHCPOFFER is then routed back to the relay agent, which broadcasts it to the client on VLAN 10.

The 202 Accepted response includes a task ID for asynchronous operations. The engineer should poll the task endpoint using that ID to check the status. Once the task status is 'SUCCESS', the site creation is complete. This is the standard pattern for DNA Center Intent API operations that are long-running.

The authentication event server dead action authorize vlan 100 command instructs the switch to place the port into VLAN 100 if the RADIUS server is considered dead (unreachable). This provides a fallback for users when the authentication server cannot be contacted, allowing limited access as defined by the guest VLAN. This is the correct feature for the scenario.

The monitor session statement names GigabitEthernet1/0/1 as source with the 'both' keyword, so ingress and egress frames on that port are replicated to the destination port GigabitEthernet1/0/2. SPAN copies traffic; it does not alter forwarding on the access port.

The LISP Map-Server maintains the mapping of endpoint identities (EIDs) to routing locators (RLOCs), effectively tracking endpoint location and identity. It registers EID-to-RLOC mappings from fabric edge nodes and responds to map requests. This enables policy-based segmentation and mobility by allowing endpoints to be reached regardless of their location. Thus, it is the correct component.

Combining transport input ssh on the VTY lines with an access-class ACL that permits only 10.10.10.0/24 restricts remote management to SSH from the management subnet. Telnet and other line-based protocols are refused because transport input is limited to ssh, and non-permitted source addresses are dropped by the ACL before they reach the VTY lines, satisfying both requirements.

In the policy-map, the voice class is configured with the priority command, which creates a strict priority queue capped at 10% of the interface bandwidth, ensuring Voice over IP packets are serviced first and minimizing delay and jitter. The video class uses the bandwidth command, which reserves a minimum of 30% of link capacity for video traffic using class-based weighted fair queuing (CBWFQ), though this does not guarantee immediate scheduling over other classes. All other traffic falls into the default class, where the fair-queue command applies, permitting equal distribution of the remaining bandwidth among remaining flows. Thus, the statement accurately describes the configured queuing behavior.

Streaming telemetry pushes continuous, model-driven data from network devices to Cisco DNA Center, enabling near real-time analytics rather than polling-based SNMP collection. This satisfies the stem's Assurance requirement for live health monitoring, rapid fault detection and granular visibility into device and client performance across the fabric.

The transform set is correctly defined. The commands `esp-aes 256` and `esp-sha256-hmac` under `crypto ipsec transform-set` specify the Encapsulating Security Payload (ESP) with AES-256 for confidentiality and the SHA-256 HMAC variant for integrity and authentication. This is a valid and secure combination for a site-to-site IPsec VPN. The statement matches the configuration, making it the correct answer.

The `shape` command with a CIR of 500000 bits per second configures a token-bucket shaper that limits the long-term average transmit rate to 500 kbps. Unlike policing, shaping smooths traffic by buffering excess packets in a queue, then sending them at the configured rate, so the output is a regulated, even flow rather than bursty with drops. This is exactly what the policy-map does for the matched traffic.

The encoding in a gRPC telemetry receiver must be either 'encode-json' or 'encode-gpb' because gRPC natively carries JSON or Google Protocol Buffers payloads. 'encode-kvgpb' (Key Value GPB) is a legacy binary encoding used with Cisco's old telemetry transport over TCP, not with gRPC. If you specify 'encode-kvgpb' under a gRPC receiver, the session fails to establish or sends malformed data. Therefore, the correct fix is to switch the encoding to 'encode-json' or 'encode-gpb'.

A VM escape exploits a hypervisor or virtualisation flaw so code running inside a guest breaks containment, reaching the hypervisor or neighbouring VMs. This is precisely the definition the stem requires: breaking out of a virtual machine to access the hypervisor or other VMs.

A routing problem is indicated by the higher encaps count compared to decaps count. This means packets are being encrypted and sent into the tunnel, but fewer packets are arriving and being decrypted from the remote peer. Typically, this is caused by missing return routes, asymmetric routing, or firewall rules that drop encrypted traffic in one direction, leading to packet loss.

This sequence enables the NV overlay feature, creates the NVE interface, sets the loopback as the tunnel source, adds the VNI as a member, and maps VLAN 100 to VNI 10000 using vn-segment under the SVI. This is the correct Nexus 9000 method for defining a VTEP and binding a VLAN to a VNI for Layer 2 VXLAN bridging. All required elements are present and correctly placed.

The NAPALM driver name must match the device's actual operating system family. For IOS-XE devices, the correct driver is 'iosxe' because that driver uses the appropriate command syntax and parser for IOS-XE's 'show ip arp' output, while the 'ios' driver is reserved for classic Cisco IOS (e.g., Catalyst 2960 running IOS 15.x). Passing 'ios' to an IOS-XE device will make NAPALM issue classic IOS commands that IOS-XE may reject or parse incorrectly, causing the script to fail with an error such as 'unable to execute command' or an invalid output error.

The command `snmp-server enable traps snmp linkdown linkup` explicitly enables only the linkDown and linkUp notifications, and `snmp-server host 192.168.1.100 public` designates 192.168.1.100 as the trap receiver using the community string 'public'. Because version 2c is the default for this command, the traps are sent as SNMPv2c with 'public' as the community string. This is the intended behavior described in the question, so this option is correct.

A Type 1 hypervisor runs directly on the branch server's hardware without a host OS, delivering near-native performance for production VM workloads. Centralized management via vCenter or a similar tool provides enterprise-grade features such as live migration, centralized logging, role-based access control, and snapshot-based backup—essential for managing a branch ISRv and DHCP server. This approach maintains the isolation and resource control needed for a virtual router while giving administrators a single pane of glass for the entire branch environment.

This is correct because 'snmp-server enable traps' alone only enables the trap subsystem globally; it does not automatically enable every notification type. On Cisco IOS, high CPU and memory utilization traps require explicit configuration with commands such as 'snmp-server enable traps cpu threshold' and 'snmp-server enable traps memory', often combined with 'snmp-server cpu threshold' to set the actual trigger level. Without these specific commands, the router will not emit the desired performance traps.

SGTs are used in Cisco SD-Access to provide micro-segmentation. Each endpoint is assigned an SGT, and group-based policies (SGACLs) enforce traffic between groups. This allows segmentation without traditional VRFs on every switch, meeting the requirement for secure departmental separation.

EF (Expedited Forwarding) with DSCP value 46 is the standard marking for voice traffic. It provides low latency, low jitter, and low loss, which are critical for voice quality. Voice traffic should be marked with EF to ensure it receives priority treatment in the network. This is a widely accepted best practice.

An IP SLA operation on its own only generates probe results; it has no effect on routing, redundancy, or other services until those results are consumed by a tracking object. The missing piece is a command like 'track 1 ip sla 7389dc reachability' (or 'track 1 ip sla 7389dc' on some software versions) that polls the operation's return code and exposes it as an up/down state. Without a track object, nothing references the IP SLA, so the router never acts on the probe failure—hence the correct answer.

CRC errors and runts are statistical counters that typically indicate frame corruption at the data-link layer, almost always rooted in physical-layer problems. Faulty patch cables, damaged RJ-45 connectors, improper termination, or electromagnetic interference near the cable can cause bit-level corruption that the NIC detects as cyclic redundancy check failures. Runts—frames shorter than 64 bytes—frequently accompany this condition when transceivers detect a signal loss or electrical anomaly mid-frame. Therefore, inspecting the physical path from the switchport through the patch panel to the end device is the first and most effective troubleshooting step.

With the route-map applied to the neighbor in the outbound direction, every BGP route that is being advertised toward 10.0.0.2 is processed through the 'set metric 50' command. This sets the MULTI_EXIT_DISC (MED) attribute to 50 on those advertised routes, thereby signaling the external peer that this path is more preferred for incoming traffic. Since the direction is explicitly 'out', the policy applies only to updates leaving the router toward 10.0.0.2.

A route-map applied in the inbound direction to neighbor 10.0.0.2 will process received BGP updates and modify their origin attribute to incomplete (value 2). Since origin is a well-known mandatory attribute considered during best-path selection, incomplete is less preferred than IGP (0) or EGP (1). This makes the route less attractive within BGP path selection.

The update-policy on-change setting makes the subscription push telemetry only when the subscribed YANG state data changes, rather than at fixed intervals. The xpath filter scopes this to GigabitEthernet0/0/0's state, so no periodic stream occurs while values remain static.

The access-list 10 is used as a source IP filter that permits exactly the 192.168.1.0/24 subnet, and this ACL is explicitly associated with the community string 'MyComm' through an SNMP server command (e.g., snmp-server community MyComm RO 10). Because the RO (read-only) keyword is present, only read operations such as GET, GETNEXT, and GETBULK are allowed; write operations like SET are silently rejected even for hosts in the permitted network. Therefore, any device in 192.168.1.0/24 that supplies the correct community string can successfully perform SNMP reads, while all other sources are implicitly denied by the ACL's implicit deny rule.

Each VRF maintains its own separate routing and forwarding table, so identical IP prefixes can exist in different VRFs on the same router without conflict. This satisfies the stem's requirement for overlapping IP addresses between virtual networks.

The 'ip flow ingress' command enables NetFlow for ingress traffic on the interface. It tells the switch to capture flow data for packets entering that interface and export it to the configured collector. This is the correct command to meet the requirement of exporting only ingress traffic from a specific interface.

YANG provides the schema language describing configuration and state data, and both NETCONF and RESTCONF use those models to structure their payloads. This shared modelling role is why the same YANG module can be consumed by either protocol.

This is the correct RESTCONF URI to retrieve the hostname from the Cisco IOS XE native YANG model. The GET method is used to read data. The URI path follows the YANG model structure, starting with the module name and then the data node. This will return the hostname if configured.

The ip helper-address command is configured on the client-facing interface and instructs the router to forward UDP broadcasts, including DHCP DISCOVER and REQUEST, to the specified server as unicast packets. It also inserts the giaddr field with the interface IP so the server can select the correct pool. This directly satisfies the scenario.

In a SPAN configuration, the switch automatically reconfigures the designated destination port as a SPAN destination port. This places the port into a specialized monitoring mode where it no longer participates in the normal Layer 2 forwarding process, meaning it will not forward unicast or broadcast frames destined for end stations. Consequently, any device connected to that port will lose normal network connectivity and only receive the copied traffic from the SPAN session. This automatic behavior is a core characteristic of Cisco switches and is the direct cause of the observed symptom.

NAPALM's get_arp_table() method returns a list of dictionaries, not raw text or a custom wrapper. Each dictionary represents a single ARP entry and includes structured keys such as 'interface', 'ip', 'mac', and 'age', making the data directly usable in Python logic such as filtering or comparison. This is the expected data model for NAPALM across multiple network platforms, because it normalizes vendor-specific CLI output into a consistent, machine-readable format.

In a Cisco switch stack, the active and standby switches are elected based on the stack priority value. If priorities are equal, the switch with the lowest MAC address wins. This priority can be configured with the 'switch X priority Y' command, allowing deterministic control over which member becomes active and which becomes standby.

The command 'passive-interface default' under EIGRP configuration flips the default behavior so that every interface is passive unless explicitly excluded. A passive interface does not send or process EIGRP hello packets, so it cannot form an adjacency with any neighbor. By then issuing 'no passive-interface GigabitEthernet0/1' (or the equivalent), only that interface remains active and capable of establishing EIGRP neighbors, while all other interfaces stay passive.

The source interface for the NVE interface must be reachable via the underlay network so that VXLAN tunnels can be established. Typically, a loopback interface is used, and its IP address must be advertised into the underlay routing protocol. Without reachability, VXLAN traffic cannot be encapsulated and forwarded to remote VTEPs.

VPN segments in vManage allow the creation of separate virtual private networks (VPNs) within the SD-WAN overlay. Each segment has its own routing table and can be assigned to different VRFs on the WAN Edge devices. This provides isolation between guest, employee, and IoT traffic. Policies can be applied per VPN segment, enabling granular control. This is a core mechanism for segmentation in Cisco SD-WAN.

The show vlan brief command displays a concise summary of all VLANs, including VLAN ID, name, status, and the ports assigned to each VLAN. This provides exactly the information needed to verify the current VLAN configuration on the switch.

This command specifies the WLCs that the AP should attempt to join in order of priority. It uses the primary and secondary keywords to set the order of preferred controllers, ensuring that the AP attempts to join its intended WLC first before falling back to other options. This is crucial for load balancing and for ensuring that the AP is managed by the correct controller in a multi-WLC environment.

When the remote peer has an unknown or changing IP address, the headend uses a dynamic crypto map entry with no set peer address so it can accept IKE proposals from any source. A static crypto map references the dynamic map with the set crypto map dynamic command, allowing the router to learn the peer address from the incoming negotiation and apply the correct transform set and ACL.

RSPAN mirrors traffic onto a dedicated VLAN, and in order for those mirrored frames to be bridged from the source switch to the destination switch, every switch along the path must have VLAN 200 created and permitted on its trunks. This VLAN is special: it is configured with the 'remote-span' command so that it is not treated as a regular user data VLAN, and if it is missing or pruned on any intermediate switch, the analyzed traffic will simply be dropped, and the network analyzer will never see the mirrored frames.

Native tagging, also known as inline tagging, inserts the SGT into the Ethernet frame using the Cisco TrustSec header. This allows switches and routers that support TrustSec hardware to read the SGT directly from the frame and enforce policies without needing an external mapping protocol. It is the preferred method for high-performance SGT propagation in the campus.

The 400 error arises because the endpoint mandates the siteId query parameter, so appending it to the URL satisfies that validation requirement. Without it, Cisco DNA Center rejects the request before processing. Adding ?siteId=<value> returns the device list correctly.

The match-any keyword in a class-map means the match conditions are combined with a logical OR. Consequently, a packet is classified into that class if it matches any one of the specified DSCP values—for example, either DSCP EF or AF41. This is the standard behavior for DSCP-based classification in the Modular QoS CLI (MQC).

Cisco SSL VPN (WebVPN) allows clientless access through a browser. Enabling 'webvpn' and configuring a context with a gateway provides the entry point, while URL lists or port-forwarding define accessible resources. This meets the requirement for browser-based access without a client. It is the standard configuration for clientless SSL VPN on Cisco IOS.

RESTCONF is a RESTful protocol that maps CRUD operations to HTTP methods. GET retrieves data, POST creates, PUT replaces, PATCH modifies, and DELETE removes. This aligns with the RESTCONF RFC and is how IOS XE exposes YANG-modeled configuration and state. The team can rely on these standard methods for automation, making this statement accurate and essential for designing tooling.

MKA is the control protocol that establishes the secure association between MACsec peers, electing a key server and distributing the secure association key used for encryption. It runs over EAPOL frames and is fundamental to how MACsec maintains and refreshes cryptographic material on a link.

EIGRP authenticates each hello packet and every routing update using a configured key, typically MD5 or SHA-2. If one router has authentication enabled (e.g., 'ip authentication mode eigrp' and 'ip authentication key-chain eigrp') while the peer does not, the receiving router fails the authentication check and silently discards the hello, so no adjacency can ever form. Even a key mismatch or different key-chain name on both sides produces the same failure, making this a classic common cause of missing EIGRP neighbor relationships.

NETCONF uses TCP port 830, which is separate from the standard SSH port 22. If NETCONF is not enabled on the Cisco IOS XE device via the 'netconf-yang' command, the device will not listen on port 830, and the connection attempt will fail with a socket error. The engineer's ability to SSH on port 22 does not guarantee NETCONF is active. Enabling 'netconf-yang' is required to start the NETCONF SSH server.

CPU pinning binds each vCPU to a dedicated physical core, eliminating run-queue contention and preventing unwanted context switches, which guarantees consistent processing capacity. Dedicated NUMA nodes ensure that the memory nearest to those pinned cores is exclusively used, avoiding the increased latency and reduced bandwidth of cross-NUMA memory access. Together, these measures provide deterministic, line-rate performance essential for production NFV deployments.