ENCOR 350-401 (350-401) — Questions 901–975

Ansible is agentless, connecting over SSH, and uses YAML playbooks. The cisco.ios collection provides modules like ios_vlan and ios_config to manage IOS XE devices. No software needs to be installed on the switches beyond SSH and proper credentials. This matches all requirements: declarative, agentless, YAML-based, and SSH connectivity.

Cisco TrustSec uses Security Group Tags (SGTs) assigned by ISE based on identity, endpoint posture, and other policy attributes, not on IP addressing or VLAN topology. The data plane enforces micro-segmentation through SGACLs that permit or deny traffic between source and destination SGTs, even within the same broadcast domain. ISE acts as the policy management and classification engine, dynamically updating SGT assignments and distributing access policies. Because enforcement is per security group and stateful across the overlay, this directly delivers identity-based micro-segmentation.

A path-echo operation in IP SLA sends a series of packets with incrementing TTLs to discover the path and collect per-hop latency and loss statistics. This directly matches the requirement to validate the path and gather hop-by-hop performance data. It provides detailed information about each hop, including packet loss and round-trip time per hop, making it the correct tool.

In ACI, leaf switches connect to all spine switches, forming a full-mesh at the spine level. If a spine fails, the remaining spines continue to forward traffic, so the fabric remains operational. This provides high availability and load balancing across all available paths, meeting the design requirements.

When 'logging source-interface Loopback0' is configured, the router uses the IP address assigned to Loopback0 as the source address for all outgoing syslog packets, regardless of which interface is used to route toward the syslog server. This provides a stable, predictable source IP that syslog servers can rely on for filtering and correlation. Since the command explicitly selects Loopback0, the statement is correct.

The most recent IP SLA probe returned a 'Timeout' code, meaning the router did not receive an ICMP echo reply from the target within the configured timeout period (for example, the default 5000 ms). Because the historical counters show both successes and failures, this timeout is a current, isolated signal of a possible transient connectivity problem such as congestion, routing loop, or temporary unavailability. This is the only answer that correctly interprets the latest operation's return code.

The IPv4 access-class applied inbound on all VTY lines evaluates management-plane traffic destined to the router's virtual terminal ports. Since the first ACE is a TCP deny for destination port 22, every SSH handshake packet is matched and discarded before a session can be established. The later permit ip any any then allows all other IP traffic, such as ICMP, NTP, or HTTPS, to reach the router or its interfaces, so the effect is narrowly scoped to blocking SSH only.

The 'ip summary-address eigrp 2a1744 192.168.0.0 255.255.252.0' command configures manual EIGRP summarization on GigabitEthernet0/0. This causes the router to advertise the 192.168.0.0/22 summary prefix out of that interface instead of the individual more-specific routes. To prevent routing loops, the router also installs a discard route (a route to Null0) for the summary prefix, ensuring that any traffic matching the summary but not a specific route is dropped locally.

Rollback to a known good state is the critical safety net in a CI/CD pipeline because it directly addresses the recovery-time objective after a failed deployment. The automation framework should preserve the last-known-good configuration (e.g., a snapshot, a config replace file, or a rollback token) and be able to reapply it automatically or on-demand when health checks fail. This minimizes mean time to recovery and is the only option that actively restores service rather than merely preventing or mitigating the impact of a failure.

Inline tagging uses Cisco Metadata to carry the SGT value within the Ethernet frame itself. Downstream devices that support CMD can read the tag and enforce SGACLs directly, eliminating the need to reclassify traffic based on IP or user identity at each hop, which preserves the original classification throughout the path.

DTP is Cisco proprietary, so it only negotiates trunking between Cisco switches; non-Cisco devices ignore its frames. This satisfies the stem's requirement for a true statement, since standard 802.1Q lacks any negotiation mechanism, and DTP's proprietary nature is a defining characteristic tested on the 350-401 exam.

The command output's explicit statement 'This system is the Bootstrap Router' verifies that this router has won the BSR election and currently serves as the elected BSR for the PIM domain. As the elected BSR, it is responsible for originating Bootstrap messages that advertise the RP set to all other PIM routers. A candidate BSR alone would not generate this output phrase; the router must have the active BSR role.

A routed access layer with IS-IS or OSPF is the required foundation for an SD-Access underlay. Link-state protocols offer rapid convergence, loop-free topology, and hierarchical scalability, which are essential when building a large leaf-and-spine fabric. The underlay is a pure L3 network, and all devices carry only unique loopback/p2p addresses, allowing the overlay (LISP/VXLAN) to run independently of L2 constraints. Without this routed design, the fabric cannot propagate reachability efficiently and may revert to spanning-tree, which is explicitly contrary to SD-Access best practices.

NetFlow version 5, 9, and IPFIX can use UDP as the transport protocol for exporting flow records to a collector. UDP is commonly used because it is lightweight and the loss of some flow records is acceptable for monitoring purposes. However, some versions like NetFlow v9 can also use SCTP, but UDP is a valid option. This statement is true.

The output explicitly contains 'Vlans allowed on trunk: 10,20'. On Cisco Catalyst switches, this line is the definitive list of VLANs permitted to traverse the trunk link; all other VLANs, including VLAN 1, are pruned or dropped at ingress. Thus only VLANs 10 and 20 are eligible for trunking, making this statement correct.

This command correctly specifies the loopback 0 interface as the source for VXLAN tunnel traffic. It ensures that the VTEP IP address is derived from a stable, always-up interface, which is a best practice for VXLAN deployments. The loopback interface provides redundancy and avoids disruption if a physical interface goes down.

The NVE interface requires a source-interface, typically a loopback, to establish the VTEP address used in VXLAN tunnels. If the source interface is missing or the VNI-to-VLAN mapping under the NVE interface is incomplete, the switch cannot build tunnels or map traffic into VNIs. This directly explains why VXLAN tunnels to remote leaf switches are not forming in the scenario.

The route-map is evaluated in ascending sequence order, and each BGP route is checked against the clauses. The first clause is a deny statement that matches the prefix-list for 10.0.0.0/8, so any route within that aggregate is rejected. The subsequent permit clause with no match conditions acts as a catch-all, allowing every other route. Thus, only routes that fall under 10.0.0.0/8 are filtered, while all other prefixes from the neighbor are accepted.

Each SD-WAN VPN maps to a distinct VRF on the edge device, so routes and forwarding tables remain separate between segments. This satisfies the multi-tenancy requirement for Layer 3 isolation, preventing traffic leaking between tenants or departments.

This sequence correctly defines an IKEv2 proposal with AES-256 encryption, SHA-256 integrity, and DH group 14. It then creates a keyring with a peer address and matching local and remote pre-shared keys. This is the proper syntax for IKEv2 configuration on Cisco IOS, ensuring the proposal and keyring are correctly associated for the VPN.

The MQC framework is the standard Cisco DiffServ implementation: a class-map matches traffic by DSCP (EF for voice, AF41 for video), and a policy-map assigns an explicit priority queue to EF while reserving a minimum bandwidth portion for AF41. Priority for EF ensures low-latency treatment for voice, while the bandwidth guarantee protects video from starvation during congestion, aligning with the EF and AF PHBs defined in RFC 3246 and RFC 2597. This provides the required differentiated treatment in a scalable, class-based manner.

The 'show ip sla statistics' command provides a summary of the operation's results, including the number of successes and failures. This helps administrators quickly assess the reliability of the monitored path or service. It is a key piece of information for validating SLA compliance.

The default EIGRP hello interval is 5 seconds on most media, and the default hold time is 15 seconds, meaning the hold time is exactly three times the hello interval. This 3:1 ratio is the Cisco default and is what 'eigrp d5bb85' refers to in the command output. A router uses this multiplier to determine when a neighbor is unreachable after missing consecutive hello packets.

In an MPLS L3VPN, the CE router must have a route—either a default route or a specific prefix—that points toward the PE's VRF-facing interface as the next hop. Without such a route, the CE cannot forward packets to the PE for remote VPN destinations, so pings from the CE fail. The PE can still ping remote sites because its VRF routing table contains the remote VPNv4 routes, which proves the problem is the CE's missing next hop rather than the PE's VRF configuration.

The TACACS+ server's command authorization policy is the decisive factor here. When the server was upgraded, the default authorization behavior for commands likely changed from permissive to restrictive, meaning that without explicit 'permit' statements for each command, the server will respond with a denial. The existing rules on the TACACS+ server may not cover all commands that the user is trying to execute, so even though the router correctly forwards authorization requests, the server's deny response blocks the commands. The fix is to update the TACACS+ server's rule set to explicitly permit the required commands at privilege level 15.

Dynamic Trunking Protocol (DTP) is a Cisco proprietary Layer 2 protocol operating on point-to-point Ethernet links to automatically negotiate a common trunking mode (access, trunk, desirable, auto) and establish an 802.1Q trunk when both switches are DTP-capable. It sends DTP frames on the native VLAN to determine whether the neighboring port is willing to become a trunk, thereby eliminating the need for manual trunk configuration. However, DTP only negotiates the trunking state; it does not define which VLANs are allowed on the trunk.

Implementing a loop that increments the offset by the current limit is the canonical way to handle offset/limit pagination. The loop should begin with offset=0 and continue fetching pages, incrementing offset by the limit each iteration, until the returned page contains fewer items than the requested limit (or zero), signaling the last page. This approach is efficient, deterministic, and works whether the total record count is known or not, making it the correct fix for the script.

This command enables OSPF process 1 on the interface and assigns it to area 0. It is the interface-level method for enabling OSPF, which is precise and avoids the need for network statements. This is the recommended practice in modern Cisco IOS because it directly associates the interface with the OSPF process and area, reducing configuration errors.

This static NHRP mapping on the spoke tells the spoke that the hub's tunnel interface 10.0.0.1 is reachable through the hub's physical NBMA address 192.168.1.1. Since the spoke needs to send initial NHRP registration and traffic to the hub before it learns dynamic mappings, this static map is essential. It is configured on the spoke, not the hub.

This command enables OSPFv3 on the interface and associates it with OSPF process 1 and area 0. It is the correct way to enable OSPFv3 for IPv6 on an interface in Cisco IOS. The process ID must match the one configured in the global 'ipv6 router ospf' command. This command is essential for OSPFv3 operation on a per-interface basis.

This is correct. The 'priority' command places VOICE in a strict-priority (LLQ) queue and, during congestion, guarantees it the configured 10% of interface bandwidth so it cannot be starved by other traffic. The 'bandwidth' command reserves 30% of bandwidth for VIDEO, ensuring its minimum service under load. The default class with 'fair-queue' applies flow-based WFQ to all other traffic, which fairly shares the remaining bandwidth without dropping any class outright.

In local mode, the AP establishes a CAPWAP tunnel to the Catalyst 9800-CL and the controller handles all client authentication, including 802.1X and dynamic VLAN assignment. This centralizes configuration and keeps the APs simple, matching the requirement for minimal AP configuration. Local mode is the standard controller-based deployment for branch offices with centralized management.

This configuration defines an access list (101) that matches traffic from 10.1.1.0/24 to 10.2.2.0/24, and references it in the crypto map with the 'match address' command. This access list identifies the interesting traffic that will be encrypted by IPsec. The crypto map also sets the peer and transform set, completing the IPsec configuration.

A Q Cnt (queue count) of 0 means there are no EIGRP packets queued for transmission to the neighbor, indicating that all updates, queries, and replies have been processed and acknowledged, which is characteristic of a fully established adjacency. The presence of a valid, non-zero uptime value for both neighbors confirms that they have successfully completed the initial neighbor discovery and exchange process and are actively exchanging routing information. Thus, the output directly supports the conclusion that both neighbors are fully established and exchanging EIGRP routing information.

Leaf-spine is a two-stage topology where each leaf switch connects to every spine switch, forming a full mesh that provides predictable, uniformly low latency between any two servers. Equal-cost multipath (ECMP) enables traffic to be hash-distributed across all available spine uplinks, maximizing aggregate bandwidth while avoiding link oversubscription. Adding spine or leaf switches scales bandwidth and port density linearly, and the multiple active paths deliver fast failover and high availability, making this design ideal for heavy east-west virtualization traffic.

Type 2 EVPN routes are used to advertise MAC address and optionally IP address reachability. In a VXLAN EVPN fabric, leaf switches advertise their locally learned MAC addresses using Type 2 routes. This allows other leaf switches to learn remote MAC addresses and forward traffic accordingly. Type 2 routes are essential for Layer 2 connectivity and are the correct choice for advertising MAC address reachability.

VRF selection is driven by the ingress interface. Because the receiving interface is bound to VRF CUSTOMER_A, the router performs the lookup in the CUSTOMER_A forwarding table, where the 10.20.30.0/24 route may point to a different next hop than the global entry, keeping tenant traffic isolated.

PIM sparse mode builds a shared tree rooted at the RP, so all sources and receivers initially meet there; dense mode floods instead and uses no RP. This directly satisfies the question's requirement that the RP anchors the shared distribution tree.

RESTCONF is a RESTful protocol that also uses YANG models. It maps YANG data to HTTP methods (GET, POST, PUT, PATCH, DELETE) and uses JSON or XML. Cisco IOS XE supports RESTCONF over HTTPS. It is ideal for web-based automation and integrates well with modern tooling. It is a valid protocol for model-driven configuration.

MKA (MACsec Key Agreement) requires both peers to derive the same Connectivity Association Key (CAK) from the configured pre-shared key. If the PSKs differ, each switch computes a different CAK, so MKA authentication fails and no secure channel is established. This is the most direct cause of MACsec failing on a point-to-point link when both ends are configured with PSKs.

DAI intercepts ARP packets on untrusted ports and compares each packet's sender MAC and sender IP against the DHCP snooping binding database, dropping any mismatch. This satisfies the stem's requirement for a true statement, since the binding table is the sole trust anchor DAI consults before forwarding ARP traffic.

An interface assigned to a VRF contributes its connected route to that VRF's table only if it has an IP address. If the interface has no address, or if no static route or routing protocol is configured inside the VRF address family, the VRF routing table will be empty. This matches the symptom of show ip route vrf CUST_A returning no routes.

This is correct because in a VRF, the route-target export (RT 1:1) is attached as a BGP extended community to all routes the VRF advertises, while the route-target import (RT 2:2) filters incoming routes based on whether they carry RT 2:2. Since the export and import RTs are independent, this asymmetric configuration allows the VRF to selectively exchange routes with other VRFs or VRF instances in a hub-and-spoke or inter-VRF routing design, without needing the RTs to match.

The 'source-interface loopback1' command under the NVE interface configuration sets Loopback1 as the source for all VXLAN encapsulated traffic. Since Loopback1 is also used for BGP EVPN peering, this ensures consistent reachability and avoids asymmetric routing. This is the correct way to bind the VTEP source to a specific loopback, which is a common best practice in VXLAN EVPN deployments.

This option is correct because get_facts() is a NAPALM method that returns a dictionary containing key-value pairs of device information, including hostname, model, uptime, serial number, os_version, and vendor. The script likely calls this method and then prints the resulting dictionary to the console. This dictionary provides a normalized, vendor-agnostic view of the device's basic identity and operational state, which is useful for inventory and auditing purposes.

The script calls send_command with 'show ip interface brief' and prints the returned string, so its purpose is purely read-only retrieval of interface status. No configuration commands are sent, distinguishing it from a configuration or backup script.

Model-driven telemetry relies on YANG data models to define precisely which data nodes are streamed, giving structured, schema-driven output. This satisfies the requirement that the data to be streamed is specified by models rather than arbitrary OIDs.

In VRF-lite or MPLS L3VPN, route targets control the import and export of routes between VRFs. By configuring matching route targets on two VRFs, routes from one VRF can be imported into another. This is the standard method for route leaking between VRFs. It allows controlled communication between VRFs without merging them entirely.

The command 'interface vlan 1' enters the configuration mode for the switched virtual interface (SVI) associated with VLAN 1. This allows the administrator to assign an IP address to the management VLAN. This is the correct method to configure Layer 3 connectivity on a switch for management purposes. It is a fundamental step in setting up in-band management on Cisco switches.

MAB provides fallback authentication when a device lacks an 802.1X supplicant, satisfying the stem's requirement for non-802.1X-capable endpoints. The switch learns the source MAC address and forwards it to the RADIUS server as both username and password. This permits printers, cameras and similar devices to gain network access without supplicant software.

The enable authentication method verifies the user against the locally configured enable password or enable secret before granting privileged EXEC mode. It is a distinct method from login authentication, which validates via line, local, or AAA credentials.

RESTCONF is not enabled by default on IOS XE. The 'restconf' global command starts the RESTCONF agent, and it depends on the HTTPS server being active via 'ip http secure-server'. Without these, the device will not accept RESTCONF requests, resulting in connection failures or 401 errors. This step is mandatory before any RESTCONF API call can succeed.

Ansible is agentless, connecting to devices over SSH, and uses YAML-formatted playbooks to define automation tasks. It includes modules such as ios_config and ios_command that specifically target Cisco IOS XE devices. This matches all stated requirements: no agent, YAML syntax, and SSH communication, making it the correct choice for this scenario.

OMP is the SD-WAN control-plane protocol that runs between WAN Edge devices and the vSmart controller over DTLS/TLS. It advertises TLOCs, service-side routes, and centralized policy, enabling the controller to orchestrate fabric reachability without hairpinning data traffic. This matches the requirement of a single control plane with direct branch-to-branch data forwarding, so it is the correct choice.

The 'propagate sgt' interface command instructs the switch to take the SGT it has associated with a received frame (either from its own classification or from an upstream TrustSec device) and insert that tag into the 802.1Q or MACsec header of packets forwarded out of this interface. This is an egress tagging action only — the switch is not learning SGTs from the neighbor on this port, nor is it applying any policy decision. It enables downstream devices that are TrustSec-capable to receive the SGT and use it for their own enforcement, effectively extending the TrustSec domain across that link.

The network command under router ospf with a wildcard mask matching the LAN subnet will advertise the LAN prefix into OSPF regardless of the WAN IP address. This is the standard method to enable OSPF on an interface and advertise its connected network. It does not depend on the WAN IP, so it remains stable when the DHCP lease changes.

The failure occurs because Cisco IOS does not support the SSH exec channel that Paramiko's exec_command() uses; it expects a full interactive terminal session. When exec_command() sends a single command, IOS has no mechanism to run it directly and may close the channel or ignore it. The correct approach is invoke_shell(), which allocates a VTY session and lets the automation interact with the CLI prompts.

In local mode, access points establish a Control and Provisioning of Wireless Access Points (CAPWAP) tunnel to the WLC for both management and client data traffic. This allows the WLC to be the single point of management and ensures client traffic is tunneled back to the WLC. Local mode is the default and most common deployment mode for centralized wireless networks.

This sequence turns on authentication globally, creates the MD5 key, marks that key as trusted so the router accepts it, and associates the key with the server. Each step is required: without `ntp authenticate` the router ignores authentication, without a trusted key it rejects valid packets, and without the key number on the server command it will not use the key for that peer. Together they enforce authenticated peering.

VRF segregation creates an independent routing and CEF table, so next hops must reside within the same VRF. If the next-hop addresses belong to the global table, they are unresolvable inside VRF TENANT_A, leaving prefixes present but next hops unreachable.

Setting the bridge priority to 61440, the maximum valid value, makes this switch the least preferred candidate in the root bridge election, so it can never assume the root role. Enabling Root Guard on the uplink ports monitors incoming BPDUs and places any port receiving a superior BPDU into a root-inconsistent state, blocking that path and preserving the current root. Together, these actions ensure the switch stays as a non-root and remains resilient against an unauthorized switch attempting to claim root.

Changing the tunnel group authentication method to certificate is the correct action because the tunnel group is where the ASA determines whether to accept usernames/passwords, client certificates, or both. Once the AnyConnect client presents a certificate, the ASA must be configured with the authentication method of 'certificate' (or 'both') in the matching tunnel group to validate that certificate and map it to a user identity. Without this setting, the ASA falls back to its default AAA login prompt, ignoring the client's certificate and causing the exact behavior seen where users can establish a network connection but cannot authenticate.

BGP sessions flapping indicate that the CoPP policy is dropping legitimate BGP keepalives or updates due to an overly restrictive rate limit. Increasing the rate limit for the BGP class-map allows sufficient BGP control traffic to reach the route processor while still protecting against excessive traffic. This balances protection with operational stability.

This is the correct answer. The summarized configuration shows a telemetry subscription that uses gRPC as the transport, with a destination-group pointing to the receiver at IPv4 10.10.10.10 port 50001. The sensor-group filters interface statistics, and the update-policy periodic 500 means those statistics are pushed every 500 seconds, independent of whether the values changed. This correctly describes a periodic push of interface counters to the specified collector over gRPC.