ENCOR 350-401 (350-401) — Questions 976–1050

Correct. In NFVIS, you can create a Linux bridge that acts as a virtual Layer 2 switch. Attaching both VNFs' vNICs to the same bridge places them in the same broadcast domain, allowing direct communication via MAC learning and forwarding. Alternatively, if the VNFs reside on different bridges (separate Layer 2 domains), you can use a virtual router—either a VNF configured for routing or NFVIS's own virtual switch—to route packets between those bridges. This is the standard method for inter-VNF connectivity on a single NFVIS host.

'merged' adds the configuration to the existing one without removing other settings.

100 Mbps is the OSPF default reference bandwidth defined in RFC 2328, and it is used in the formula cost = reference-bandwidth / interface-bandwidth. With this default, a 100 Mbps interface has a cost of 1, and any interface faster than 100 Mbps also receives a cost of 1 because OSPF costs are integer values; this is why network administrators often raise the reference bandwidth in modern high-speed networks.

This correctly describes the `cts manual` command with a `sap pmk` policy: manual TrustSec mode uses a pre-shared key to bring up a Security Association Protocol session. After SAP is established, the interface performs inline SGT tagging, inserting the SGT into the CMD (Cisco Meta-Data) header of each frame so the peer can enforce security-group-based policies. The pre-shared key authenticates the peer for this SGT exchange, not for user authentication.

DiffServ uses DSCP to classify traffic. EF (46) provides low latency, low jitter and assured bandwidth for voice, and a strict priority queue services it ahead of all other classes, guaranteeing voice is prioritised over video and data.

RESTCONF is the IETF model-driven interface that maps YANG models onto HTTP methods and runs over HTTPS on TCP port 443. Setting the Accept header to application/yang-data+json tells the device to return JSON-encoded structured data rather than XML. This directly satisfies the requirement for a programmatic, model-driven interface over HTTPS without CLI screen-scraping.

DNA Center's assurance engine ingests streaming telemetry from wireless controllers and access points, then computes per-client and per-AP health scores from that data. This satisfies the stem's requirement for wireless assurance: continuous monitoring and scoring rather than configuration alone, giving visibility into client experience and radio performance across the fabric.

GPB (Google Protocol Buffers) is a binary, schema-based serialization format that produces compact payloads, drastically reducing bandwidth and CPU overhead compared to text encodings. Its generated codecs and native support in gRPC make it the standard choice for high-volume, model-driven streaming telemetry on Cisco platforms. Because the schema is defined in .proto files and tied to YANG models, decoding is fast and unambiguous, even under sustained telemetry rates.

The client with MAC 00:11:22:33:44:88 is in Probe state, which means it has transmitted probe requests and is listening for probe responses from potential APs. It has not yet performed 802.11 authentication or association, so it is effectively attempting to connect but is not an associated client and cannot exchange data traffic. This precisely matches the correct statement: it is trying to associate but is not yet connected.

Setting access ports to access mode and disabling DTP prevents the port from negotiating a trunk, which is a primary vector for VLAN hopping attacks. Attackers can exploit DTP to form a trunk and gain access to all VLANs. By explicitly configuring the port as access and disabling DTP with 'switchport nonegotiate', the port will not trunk. This is a recommended best practice.

SD-Access enforces group-based policy using SGTs applied to endpoints, rather than traditional IP-based ACLs. This satisfies the stem by naming the actual tagging mechanism that the fabric's policy plane relies on for segmentation and contract enforcement between scalable groups.

When an interface is assigned to a VRF using the ip vrf forwarding command, any existing IP address is removed because the interface's IP address is now part of the VRF's routing table. The engineer must re-enter the IP address configuration after the VRF assignment. This is a common operational step when configuring VRF-lite.

The configuration combines both Auto-RP roles: the router is a candidate RP because it announces itself for the 239.0.0.0/8 group range, and it is also the RP-mapping agent because it sends RP-discovery messages. The 'scope 10' parameter limits the TTL of these Auto-RP messages to 10 hops, controlling how far the announcements and discovery messages propagate.

Client 360 is a feature in Cisco DNA Center Assurance that provides a comprehensive view of a specific client device. It includes a detailed timeline of events such as onboarding, authentication, DHCP, DNS, and application usage. This allows administrators to troubleshoot client-specific issues by correlating events over time. It is the correct tool for this scenario because it gives a holistic view of the client's network experience.

The script passes a list of interface-level commands to `send_config_set()`, which enters global configuration mode and applies each line in sequence. This sets the description, assigns 10.1.1.1/24, and issues `no shutdown`, satisfying the stem's requirement to configure and enable GigabitEthernet1/0/1 on the IOS-XE device.

Cisco Meta Data (CMD) is the TrustSec inline tagging mechanism that inserts the SGT into a reserved field of the Ethernet frame. Enabling CMD on the inter-switch uplinks allows each hop to read the tag and apply Security Group ACLs without re-classifying based on IP address, which is exactly the inline tagging behaviour the scenario requires.

BSR messages are PIM protocol packets forwarded hop by hop, so every transit interface between the BSR and downstream routers must have PIM enabled. Without PIM on those links, the bootstrap messages are dropped and routers never receive the RP set, even though the BSR itself receives candidate RP advertisements.

The candidate capability allows the script to edit the candidate datastore, validate changes, and commit them atomically. Without it, direct edits to the running datastore may not support rollback or validation, violating the atomicity requirement. Checking for this capability ensures the device supports the candidate configuration workflow.

This is correct because IP SLA reactions define what happens when a monitored threshold is breached. By specifying a reaction condition (e.g., timeout) and an action (e.g., logging, SNMP trap), the device generates syslog messages and SNMP traps when the SLA operation fails or exceeds the threshold. This directly enables correlation with monitoring systems.

The vEdge router is designed to establish an OMP session with a single active vSmart controller at any given time, while concurrently maintaining DTLS/TLS tunnels to additional vSmart controllers for redundancy. The active vSmart processes all route exchanges and policy decisions; the backup vSmart remains in a standby state, ready to assume control automatically if the active vSmart fails. This active/standby model ensures control-plane continuity without requiring manual intervention or reboots.

Import route targets are attached to VRFs; when MP-BGP receives a VPNv4 route, the route target extended community is matched against the VRF's import list, determining whether that route enters the VRF's routing table. This satisfies the constraint of controlling route import.

In the EXSTART state, OSPF routers exchange Database Description (DBD) packets to negotiate the master/slave relationship and begin advertising their link-state databases. DBD packets are often the largest OSPF packets sent, and if one router has a lower interface IP MTU, the DBD packet may exceed that MTU and be silently dropped by the receiving router's IP stack. Because the DBD packet never arrives, the routers cannot complete the master/slave negotiation and remain stuck in EXSTART indefinitely. This is a textbook symptom of an MTU mismatch on the OSPF interface.

When an address is logged as a conflict, the DHCP server removes it from the normal allocation pool and will not offer it in future DISCOVER messages until the conflict is explicitly cleared. Both 10.0.0.10 and 10.0.0.15 remain in this conflicted state, making them permanently unavailable for DHCP assignment unless an administrator runs 'clear ip dhcp conflict' or removes the entries. This exclusion prevents the server from duplicating addresses already in use elsewhere.

CAPWAP (Control and Provisioning of Wireless Access Points) is the standard protocol for AP-to-WLC communication. It uses DTLS to encrypt control and data traffic, and it supports Layer 3 discovery via broadcast, DHCP option 43, or DNS. Enabling DTLS ensures management traffic is encrypted, and CAPWAP operates across Layer 3 networks, satisfying both requirements.

Key-Value GPB encoding serialises each telemetry field as a key-value pair within a compact protobuf message, which the gRPC-TCP receiver at 10.2.2.2:50001 decodes natively. This satisfies the dial-out subscription's requirement for efficient, structured streaming of the periodic 500-centisecond interface counter data over gRPC.

gRPC (Google Remote Procedure Call) is the correct answer because Cisco DNA Center leverages model-driven telemetry, and gRPC is the standard transport for that telemetry. It uses protocol buffers to encode structured YANG data and supports high-frequency, push-based subscriptions over HTTP/2. This allows DNA Center to stream interface counters, CPU/memory utilization, and other operational state from devices in near real-time, eliminating the need for repeated polling.

UDP jitter is designed to assess network performance by sending multiple UDP packets and computing latency, jitter, and packet loss. It requires an IP SLA responder on the far end because the responder must embed precise transmit and receive timestamps into each packet and return them to the source. Without the responder, the destination would not process the IP SLA control messages or generate the timestamped reply packets, making accurate jitter measurements impossible.

Zone-Based Firewall uses zone pairs to define directional policy between zones. Applying a service policy with the inspect action on the inside-to-outside zone pair creates stateful inspection, so return traffic from the outside zone is automatically permitted. Without this inspect action, the router treats the zones as separate and return traffic would be dropped by the default inter-zone deny.

IPsec in tunnel mode encrypts the entire original IP packet, including the GRE header and payload, and encapsulates it within a new IPsec packet. This provides confidentiality and integrity for the GRE tunnel, making it suitable for transporting IPv6 over an IPv4 underlay securely. It is the standard method for protecting GRE tunnels.

An SVI is created with the interface vlan 10 command. To make it operational, you must assign an IP address and enable it with no shutdown. The SVI will remain down until at least one access port in VLAN 10 is up and the VLAN exists in the VLAN database. Once these conditions are met, the SVI can route traffic for the subnet.

Access points use CAPWAP (Control and Provisioning of Wireless Access Points) to discover and join a WLC, encapsulating control and data traffic. The WLC GUI is accessed via HTTPS by default, providing secure management. This combination meets the requirement for secure AP join and management in a large campus deployment.

In hierarchical QoS (HQoS), the outer policy performs shaping at the parent level, and after the shaper has metered the traffic to the configured rate, the inner policy is applied to the shaped output. This allows the child policy to classify and queue traffic into multiple classes, all within the aggregate shaped bandwidth. The result is that each class gets its own queue and scheduling behavior, but the total output never exceeds the parent's shaped rate, so per-class queuing occurs inside the shaper's token bucket.

The vSmart controller distributes OMP routes, policies and TLOC information across the overlay, satisfying the need for centralised control plane intelligence. It computes and pushes routing and policy decisions to WAN edge routers, which forward data plane traffic directly without transiting the controller.

LLQ is an extension of CBWFQ that adds a strict priority queue for delay-sensitive traffic such as voice. Configuring a priority statement for the voice class ensures that packets marked DSCP EF are dequeued first, up to the specified bandwidth (30%). This provides strict priority scheduling and guarantees bandwidth, meeting both requirements for voice traffic.

OSPF hellos and LSAs are being dropped because the policer for the OSPF class is too restrictive. Increasing the CIR for that class allows more OSPF control traffic to reach the route processor, stabilizing adjacencies. This maintains protection for other protocols while addressing the specific queue that is over-policing legitimate OSPF packets during normal adjacency formation and maintenance.

The global command 'ipv6 router ospf 100' creates the OSPFv3 routing process with process ID 100 and enters router configuration mode. Only after this process exists can interface-level commands like 'ipv6 ospf 100 area 0' become operational. This is the missing required step, making the configuration functional and allowing the router to exchange LSAs with its neighbors.

MQC is the framework for configuring QoS on Cisco IOS. It uses class-maps to classify traffic (e.g., matching DSCP) and policy-maps to define actions such as marking with a new DSCP value. The service-policy command applies the policy to an interface. This is the standard and correct method to classify and mark traffic based on DSCP.

The SGT is not derived from the switch's local configuration or the interface; it is assigned dynamically by the RADIUS server during 802.1X authentication via a vendor-specific attribute (e.g., cisco-avpair with cts:security-tag). If the RADIUS server does not return this attribute in the Access-Accept message, the switch has no SGT to map to the user's role, leaving the user unclassified. Consequently, even though 'cts role-based enforcement' is enabled, the switch cannot apply any SGACL because it has no valid SGT for the session. The correct fix is to configure the RADIUS server to include the appropriate SGT for the authenticated user.

Static NAT creates persistent one-to-one mappings that appear in 'show ip nat translations' as entries with an inside global address and a corresponding inside local address, but no protocol, port, or outside address fields. The output shows exactly two such pairs, meaning two internal hosts have been statically translated to two unique global addresses. Because the mappings exist in the configuration regardless of traffic, they display even when no connection is active.

The 'Remote Destination Session' type with a source RSPAN VLAN confirms this switch acts as the destination, receiving mirrored frames from VLAN 200 and forwarding them out Gi1/0/12. Ingress is disabled, so only received traffic is sent to that port.

RESTCONF is designed to use HTTP methods (GET, POST, PUT, PATCH, DELETE) and supports both XML and JSON encoding. It is built on the same YANG models as NETCONF but provides a RESTful interface that is easier to work with, especially for those familiar with JSON and HTTP. This matches the engineer's preferences.

Model-driven telemetry (MDT) with gRPC or gNMI creates a persistent subscription to YANG-defined data models, allowing the NX-OS device to push interface counters and BGP state at a configured cadence or immediately on change. This push model scales to thousands of counters without collector polling overhead and supports structured encoding (protobuf/JSON), making it ideal for real-time visibility. Unlike flow or event mechanisms, MDT is purpose-built for streaming operational state from network devices.

Correct because SD-WAN uses a controller-based approach where the control plane is centralized, simplifying policy deployment.

CoPP on IOS XE requires classifying control-plane-bound traffic with a class-map of type control-plane, then applying policing in a policy-map that is attached globally with service-policy type control-plane. An ACL matching ARP and TTL-expired packets provides the specific match, and transit traffic is unaffected because CoPP only inspects packets punted to the route processor.

Assigning a network profile to a site only stages the intended configuration; the Provision workflow must then be run to push those settings to the devices. Without provisioning, DNA Center leaves the switches untouched, so the VLAN never appears despite correct inventory and reachability.

Because ACL 140 is applied to outbound traffic on this interface, it evaluates packets as they are leaving the interface. Entry 10 permits HTTPS only from the 192.168.1.0/24 source network, while entry 20 explicitly denies HTTPS from any source that does not match that permit. Therefore, HTTPS sessions initiated from addresses outside that subnet will be denied when they attempt to exit the interface.

Configuring 802.1X with a guest VLAN allows authenticated devices to be placed into a VLAN after successful RADIUS authentication, while unauthenticated devices are assigned to a separate guest VLAN. This meets the branch requirement exactly. The guest VLAN feature is specifically designed for this scenario and is supported on Cisco Catalyst switches.

Ansible's block/rescue structure allows error handling. The configuration task can be placed in a block, and if it fails, the rescue section can execute a rollback task, such as using 'cli_command' to run 'configure replace' with a previously saved configuration file. This provides automatic rollback without manual intervention, directly addressing the requirement.

A 401 Unauthorized error indicates that the request lacks valid authentication credentials. RESTCONF on Cisco IOS XE requires authentication, typically via HTTP Basic Authentication. The engineer must include the username and password in the request headers. This is the standard method to authenticate RESTCONF requests. Without credentials, the device rejects the request, resulting in a 401 error.

The multicast routing table output for group ff2fef explicitly contains a (*,G) entry with the text 'RP 10.0.0.1', which is the Rendezvous Point address used by PIM-SM to build the shared tree. In PIM-SM, the RP is the root of the (*,G) tree; receivers join towards the RP and sources register with it. The presence of this RP statement in the output is authoritative and confirms that 10.0.0.1 is indeed the RP for this group, so the statement is correct.

For the /32 prefix, the outgoing label is 'Pop Label', which signals Penultimate Hop Popping (PHP). The router, acting as the penultimate LSR, removes the MPLS label before forwarding the IP packet to the egress router, avoiding the need for the egress to perform a label lookup. This operation reduces processing overhead and is a common optimization in MPLS networks.

An on-change subscription publishes telemetry only when the monitored interface counters actually change, satisfying the requirement to avoid fixed-interval updates. A periodic subscription would instead stream at a configured interval regardless of whether values changed.

The interface-level command 'authentication guest-vlan <vlan-id>' is required to define a fallback VLAN for devices that do not respond to 802.1X or whose authentication times out. Without this command, a non-802.1X capable device will be denied access or left in an unauthorized state, because the switch has no VLAN to assign it. The guest VLAN is a per-interface configuration, separate from global AAA commands, and it must reference an existing VLAN on the switch.

Cisco SD-WAN supports multicast over the overlay by replicating traffic through the fabric with a rendezvous point, allowing one overlay to carry both unicast and multicast. This meets the goal of a single overlay without separate tunnels for each traffic type.

In the 'show vlan' output, a port listed under a specific VLAN without any trunking indicator is an access port. Gi0/6 appears in the VLAN 20 section, and there is no mention of 802.1Q encapsulation or trunk mode, so it belongs to only VLAN 20. An access port carries traffic for exactly one untagged VLAN, and this membership confirms that Gi0/6 is an access port in VLAN 20.

This is a Local SPAN session. The source ports Gi1/0/1 and Gi1/0/2 each capture both ingress and egress traffic, and the switch copies those frames to the destination port Gi1/0/10, which resides on the same switch. The monitoring device connected to Gi1/0/10 receives a real-time copy of all traffic seen on the source ports, without any impact to the original traffic flow.

This is the correct behavior. The `point-to-point` OSPF network type is designed for links that connect exactly two routers, such as serial interfaces using PPP or HDLC. By definition, it eliminates DR/BDR election because there is no need to reduce adjacency flooding on a two-router segment, and it uses the default 10-second hello interval (with a 40-second dead interval). Configuring `ip ospf network point-to-point` is redundant when the interface already defaults to this type, but it is often used to explicitly override an interface's default OSPF network type on platforms like Ethernet or Frame Relay.

Within an MPLS L3VPN, simply running OSPF in the VRF does not make a CE route available to the MP-BGP VPNv4 control plane. The PE must explicitly execute a redistribution command, such as 'redistribute ospf 1 vrf CUSTOMER' under 'router bgp AS ... address-family ipv4 vrf CUSTOMER'. Missing this command means the OSPF-installed route stays confined to the VRF RIB; it is never given a route distinguisher, tagged with an export route target, or sent to remote PEs. Consequently, even a healthy OSPF adjacency and populated VRF still result in no VPNv4 prefix.

A centralized QoS policy, defined in vManage and pushed to all WAN edge routers, is the correct SD-WAN approach because it applies identical DSCP marking rules regardless of the underlying transport. DSCP operates at the IP layer, so it can be preserved across IPsec tunnels by instructing the tunnel to copy the outer TOS field, allowing service providers and remote routers to honor priority markings. The per-queue shaping component uses scheduling constructs such as strict priority for voice and a separate bandwidth pool for video, ensuring that real-time traffic receives predictable latency and jitter even when a transport link is congested. This transport-independent, centrally managed model is the foundation of Cisco SD-WAN QoS.

Configuring the new switch with a higher bridge priority (e.g., 28672) ensures that its BPDUs are inferior to those of the current root bridge, so Root Guard on the Layer 3 switch port will no longer block the port. Since bridge priority is the first criterion in root bridge election, setting a value like 28672 (higher than the current root's priority) makes the new switch a non-root candidate. This resolves the root guard blocking while keeping the new switch operational and preserving the intended spanning-tree topology.

Configuring NUMA pinning and CPU pinning dedicates physical CPU cores and ensures their memory is allocated on the same NUMA node, giving the VNF exclusive, non-overlapping access to compute resources. In KVM, NUMA pinning binds each virtual CPU to a specific host core and the VM’s memory to a local NUMA node, avoiding expensive remote memory accesses and eliminating hypervisor scheduler contention. This deterministic resource allocation is essential for high-throughput SD-WAN VNFs, which need stable forward rates and low jitter under load. It is the recommended NFV performance practice over any other tuning option.

232.0.0.0/8 is the default and IANA-assigned range for Source-Specific Multicast (SSM), as defined in RFC 4607. In SSM, receivers explicitly subscribe to a specific source and group using the (S,G) notation, and this dedicated /8 prefix ensures that globally unique SSM groups are used consistently across the Internet. This range is the correct answer because it is exclusively reserved for SSM operations, unlike other multicast blocks that serve different purposes. Cisco devices and other routers recognize 232/8 as the default SSM range when SSM is enabled.

AI Network Analytics in Cisco DNA Center uses machine learning to analyze historical network data, including device performance metrics and events, to identify anomalies and root causes. It can correlate data over time, detect trends, and provide insights into why a health score dropped, making it the appropriate tool for this scenario.