ENCOR 350-401 (350-401) — Questions 1051–1125

A Layer 2 loop occurs when redundant paths exist without Spanning Tree Protocol actively blocking one of them. The new switch, if connected with multiple links to the distribution switches and STP disabled or misconfigured, will forward broadcast frames out all ports, causing a broadcast storm. This leads to severe symptoms such as high CPU utilization on all switches, MAC address table flapping, and complete network unavailability.

In a Cisco SD-Access fabric, the control plane nodes (running LISP) are critical for overlay reachability. If the fabric health score is low while device health scores are high, the issue likely lies in the fabric control plane, such as LISP map-server/ map-resolver problems or inconsistent fabric domain configurations. This can cause overlay connectivity issues without affecting individual device health.

The 2.4 GHz band offers superior range and wall penetration compared to 5 GHz due to its longer wavelength and lower free-space path loss at equivalent transmit power. Using 5 GHz for backhaul likely results in marginal signal strength at the receiving AP, causing intermittent instability as environmental attenuation fluctuates. In contrast, 2.4 GHz would provide a more robust, stable backhaul link, even though it has fewer non-overlapping channels.

This is the correct choice. A FlexConnect AP can switch wireless client traffic directly on its wired interface, which removes the need to backhaul user frames to the WLC. If the CAPWAP control tunnel to the WLC is lost, the AP enters standalone mode and continues to serve the locally switched WLANs, ensuring client connectivity for remote branch sites. This resilient behavior is the primary design goal of FlexConnect, distinguishing it from Local mode.

Applying a VLAN ACL on the guest VLAN is the correct fix because it filters traffic at Layer 3/4 on the VLAN's SVI, allowing you to explicitly deny any traffic destined to internal subnets (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) while permitting public internet access. Unlike wireless features, this ACL is enforced regardless of the access point or client type, and it operates after the client has already obtained an IP address. It provides centralized, rule-based protection for the entire guest network segment.

The load-balancing method is 'src-dst-ip', meaning the switch hashes the source IP and destination IP fields to select a member link. This ensures that packets belonging to the same IP flow always traverse the same port, preserving packet ordering while distributing different flows across the bundle. This is a Layer 3 hash, commonly used for routed or L3-switched EtherChannels.

The source-address command sets the local IP the IOS-XE device uses as the origin of its gRPC dial-out connection, so the collector at 10.1.1.100 sees telemetry arriving from 10.1.1.1 rather than an arbitrary egress interface address.

The crypto ACL defines the interesting traffic that will be encrypted and sent through the VPN tunnel. It specifies source and destination subnets that are permitted, and only matching traffic is protected. On Cisco ASA, this ACL is referenced in the crypto map entry. It is the correct element to control which subnets are encrypted, as required by the scenario.

In NX-API, the `type` field in the request payload determines how the switch processes the command. Sending `show` (or `cli_show`) tells the API to execute a read-only show command and return its output, so configuration commands are never executed and the switch configuration remains unchanged. To apply configuration changes, the engineer must set the message type to `cli_conf`, which places the switch in global configuration mode and executes the supplied commands. This mismatch between the API message type and the intended operation is the root cause of the problem.

AI Network Analytics in Cisco DNA Center uses machine learning to establish a dynamic baseline of normal network behavior and detect anomalies without manual thresholds. It continuously learns from telemetry and surfaces deviations, directly matching the engineer's goal of automated anomaly detection.

The TextFSM library with a pre-defined template is correct because it applies a state-machine-driven set of regex rules to map the human-readable 'show ip interface brief' output into structured values like interface, IP address, status, and protocol. Templates are reusable across different IOS versions and even between vendors because they tolerate extra spaces and optional lines, and they produce clean lists of dictionaries for Jinja2 or Netmiko workflows. This is the standard approach used by ntc-templates and Ansible for reliable CLI parsing.

This is correct. The ACL identifies inside source addresses 192.168.1.0/24, and the ip nat pool command creates a public address range 203.0.113.10–20. The overload keyword activates Port Address Translation, permitting many inside hosts to share those 11 addresses simultaneously by rewriting source ports, rather than requiring a one-to-one mapping.

The command output states 'trust state: trust DSCP' and 'trust mode: trust dscp', confirming that the interface is configured to honor the DSCP markings carried in the IP header of incoming packets. In this mode, the switch classifies each packet according to its DSCP value and maps that value to the appropriate QoS queue or policy, without altering the original DSCP field.

Client 360 provides a comprehensive view of a specific client, including its connectivity history, onboarding events, and performance metrics. It shows a timeline of association, authentication, and roaming events, making it ideal for troubleshooting intermittent disconnects. The administrator can see exactly when the client disconnected and what happened during the process, enabling root cause analysis.

In Cisco ACI, the common tenant can host shared services EPGs, and contracts can be exported and consumed across tenants. This allows a tenant EPG to communicate with the shared firewall or load balancer while keeping other inter-tenant traffic isolated. The contract defines exactly which protocols and ports are permitted, satisfying both sharing and isolation.

Port security with a maximum MAC count enforces the learning limit, sticky learning dynamically records MACs into the running configuration, and the shutdown violation mode err-disables the port when the limit is exceeded. This directly satisfies the requirement to cap learned MAC addresses and automatically disable offending ports.

This is the fundamental ZBFW configuration. Interfaces must be assigned to zones, and zone pairs define the direction of traffic flow. For traffic to be allowed, a zone pair must exist with a policy that inspects or passes traffic. The default action for inter-zone traffic is drop, so explicit policies are needed. This step is essential to meet the requirements of inspecting inside-to-outside and allowing only HTTP/HTTPS from outside to DMZ.

The VOICE class is assigned strict priority through the `priority` command, so its packets are dequeued before any other class whenever the priority queue is non-empty. The `percent 30` keyword configures an aggregate policer that allows traffic up to 30% of the interface bandwidth and drops any excess immediately (conform-action transmit, exceed-action drop). This is a hard ceiling—excess voice traffic is not re-queued or forwarded, it is discarded on the spot.

Running a pre-task that inspects ansible_net_version and then uses conditional logic to select either the native ios_bgp module or an alternative module (e.g., ios_config) ensures that the playbook aligns with the device's supported API and syntax. This avoids silent failures caused by module versions that do not recognize the running IOS release, and it is the recommended pattern for maintaining idempotent, OS-aware automation across a heterogeneous fleet.

With APs registered and functional, association failures point to the radio layer. RF interference or a poor signal-to-noise ratio prevents clients from completing association, which Cisco DNA Center Assurance surfaces as high client association failure counts on the affected APs.

The 'show spanning-tree' command displays the STP topology, including the root bridge, root port, designated ports, and port states. It is the primary command to verify STP operation and detect loops. On a Cisco Catalyst switch, this command provides detailed information for each VLAN, helping the administrator identify the root bridge and any blocked ports.

VXLAN encapsulates the original Layer 2 frame inside a MAC-in-UDP header. The 8-byte VXLAN header, UDP header, and outer IP header allow the frame to be routed across a Layer 3 underlay. This directly satisfies the scenario requirement to carry Layer 2 frames over an IP network.

Assurance custom threshold rules in Cisco DNA Center allow you to define alerts based on specific metric thresholds, such as CPU utilization exceeding 80% for a sustained period. This directly matches the administrator's need to be notified when the condition persists for more than 5 minutes.

Network profiles bind settings such as NTP to a site, and DNA Center only pushes them to devices associated with that site. If the switch sits under a different site hierarchy, provisioning silently omits the NTP configuration, so verifying site assignment is the logical first check.

Virtual Routing and Forwarding (VRF) creates separate, independent IP routing tables and associated forwarding tables on the Provider Edge (PE) router. Each VRF instance contains its own set of routes, interfaces, and routing protocol processes, ensuring that customer A's routing information is completely invisible to customer B. This table separation is how an MPLS L3VPN achieves routing isolation, even though both customers share the same physical backbone. When combined with route distinguishers (RDs) and route targets (RTs), VRF controls the import and export of routes into the VPN, thereby maintaining strict logical isolation across a shared MPLS core.

LISP is the control plane protocol in SD-Access. The map-server registers endpoint EID-to-RLOC mappings from fabric edge nodes, and the map-resolver answers map requests from ingress tunnel routers. This enables scalable endpoint mobility and policy enforcement based on endpoint groups, exactly as required for IoT and employee segmentation across wired and wireless.

For redistributed external routes, OSPF installs the type 5 LSA only if the forwarding address is reachable through an OSPF internal route. If that address resolves via another protocol or not at all, the route stays in the database but never enters the routing table.

Cisco TrustSec assigns Security Group Tags to users and devices based on identity and group membership determined by Cisco ISE, and enforcement uses those tags rather than IP addresses or VLANs. This allows consistent policy across wired and wireless domains. Because tags travel with the traffic, access control remains intact even when subnets or VLANs change.

This header tells the RESTCONF server that the client expects the response body in JSON format according to the YANG data model. Cisco IOS XE RESTCONF uses the media type 'application/yang-data+json' for JSON-encoded YANG data. Without it, the server may return XML or an error. This is the correct header to include.

The switchport voice vlan command enables the voice VLAN feature on an access port. Data frames from the PC remain untagged in the access VLAN (100), while voice frames from the phone are tagged with VLAN 200. The phone can also receive the voice VLAN assignment through LLDP-MED or CDP, making this the correct and simplest solution for a phone-plus-PC topology.

VXLAN adds 50 bytes of overhead (outer IP, UDP, VXLAN header). The underlay must support an MTU of at least 1550 bytes (typically 1600 or higher) to avoid fragmentation of VXLAN-encapsulated packets. If the underlay MTU is too small, large packets may be dropped or fragmented, causing performance issues. Therefore, configuring jumbo frames on the underlay is a best practice for SD-Access.

Interface resets occur when the interface goes down and comes back up, typically due to physical layer problems like faulty cables, damaged connectors, or hardware issues causing link flapping. This distinguishes resets from other errors.

Authorization defines the privileges granted to an authenticated identity, so it directly governs which commands a user may execute on the device. This satisfies the stem's requirement by separating authorisation from authentication, which only verifies identity, and from accounting, which logs activity.

In a StackWise stack, the standby switch automatically takes over as master if the active master fails. The failover is designed to be hitless or near-hitless, with other stack members continuing to forward traffic without reloading. This provides high availability and minimal disruption, which is a key benefit of StackWise technology.

A 401 Unauthorized error indicates authentication failure. The most likely cause is that the username or password is wrong, or the user account lacks the necessary permissions to access the RESTCONF API. The engineer should verify the credentials and ensure the user has appropriate privilege level (e.g., privilege 15).

This is the correct configuration for transparent mode. The global access-list is the only ACL applied to a transparent ASA, and it evaluates all traffic crossing the Layer 2 bridge. The rule precisely matches the requirement: source is the inside subnet 192.168.1.0/24, destination is any, and service is TCP 443 (HTTPS), thus permitting only outbound HTTPS from the inside network while implicitly denying everything else. This adheres to least-privilege access control and is applied globally so that traffic from any interface, including the inside, is filtered consistently.

SSH traffic must be explicitly classified so CoPP can rate-limit it separately instead of letting it fall into a default or catch-all class that may be policed aggressively. Adding a TCP port 22 class with a suitable rate and transmit action preserves protection while guaranteeing management access. This is the standard CoPP design practice for management protocols.

Dictionaries map unique keys to values, so a device's IP, username and password can be stored as named fields and retrieved by key. This satisfies the stem's requirement for storing key-value pairs in automation data structures.

Security Group Tags are the classification mechanism at the heart of TrustSec, tagging packets based on user or device identity rather than IP addresses. This identity-based classification is what enables scalable, topology-independent segmentation across the network.

Ingress replication with BGP EVPN allows the leaf to replicate BUM traffic to all remote VTEPs in the EVPN control plane without using multicast in the underlay. This is the correct approach when multicast replication is not desired. The command `ingress-replication protocol bgp` enables this behavior.

YANG supports augmentation, allowing vendors to extend standard models with proprietary data. Cisco IOS XE uses augmentations to add features not covered by IETF or OpenConfig models. This is essential for managing Cisco-specific functionality. The statement is true and highlights the flexibility of YANG for vendor customization.

Retrieving task status is a read-only operation against the returned URL, so GET is the correct HTTP method. POST, PUT, or DELETE would attempt to modify or create resources, which is inappropriate for simply polling the task's current state.

Before authentication, the port stays in the uncontrolled (unauthorized) state, permitting only EAPOL traffic between supplicant and authenticator. This satisfies the stem's access-control constraint: no ordinary data frames pass until the authentication server authorises the supplicant, after which the port transitions to the controlled, authorised state.

The 'ip default-gateway' command is used on Layer 2 switches to specify a default gateway for management traffic. When the switch is not performing routing, it needs a default gateway to reach remote subnets. This command sets the gateway of last resort for the management interface. Without it, the switch can only communicate with devices on the same subnet, so this is the correct solution for the scenario.

A custom flow record built with Flexible NetFlow can reference the VRF name or VLAN tag alongside the standard 5-tuple, so flows from different customers sharing the same physical interface are tagged at the source router. Because the flow monitor is attached to the shared interface, it captures all traffic in a single pass, and the collector uses the VRF/VLAN key to separate per-customer statistics. This eliminates reliance on IP uniqueness and scales to many VPNs or VLANs without needing a separate monitor per tenant.

The command 'aaa authorization exec default group tacacs+ local' creates a default EXEC authorization list applied to all EXEC sessions. When a user attempts to start a privileged EXEC shell, the device first sends an authorization request to the TACACS+ server group; only if that server is unavailable or returns no response does it fall back to the local database. Because TACACS+ appears first in the list, it is the primary method for EXEC authorization, making this statement correct.

LLQ includes a strict priority queue that is always serviced first when packets are present, which minimizes delay and jitter for voice. This is a key characteristic of LLQ, making it suitable for real-time traffic. The priority queue is typically configured with a bandwidth guarantee and a policer to limit its maximum rate, preventing starvation of other queues.

In a totally stubby area, the ABR suppresses Type 4 (ASBR-summary) and Type 5 (AS-external) LSAs, and also replaces all Type 3 inter-area summaries with a single default route. This leaves only Type 1 (router) and Type 2 (network) LSAs for intra-area topology, plus the injected Type 3 default LSA for any traffic leaving the area. Therefore, the allowed LSA set is exactly Type 1, Type 2, and the default Type 3.

The session type is Remote Destination Session, so this switch is the destination device: it receives mirrored traffic carried in source RSPAN VLAN 300 and forwards it out of destination port Gi1/0/40. Ingress is disabled, so traffic entering Gi1/0/40 is not mirrored.

In Cisco ACI, a contract defines the rules that permit or deny traffic between EPGs. It consists of subjects and filters that specify the protocols and ports allowed. Contracts are applied to EPGs as providers or consumers. When an EPG provides a contract and another consumes it, traffic is allowed according to the contract's filters. This is the fundamental mechanism for enforcing policy in ACI, making it the correct answer.

CoPP requires a policy map to be attached to the control plane with service-policy input under control-plane configuration mode. Without this attachment, the class maps and policy map exist but are not enforced on control-plane traffic, leaving the route processor unprotected.

SR-IOV is the correct choice because it partitions a physical NIC into multiple virtual functions (VFs), each directly assigned to a VM without hypervisor involvement. The VM's vNIC maps to a VF that owns dedicated DMA queues, interrupt vectors, and packet-processing hardware, so data bypasses the software vSwitch and its CPU-intensive copying. This yields near-native throughput, low latency, and minimal host CPU overhead, making it far superior to any software-based virtualization approach.

The Client Health dashboard in Cisco DNA Center Assurance provides detailed metrics such as onboarding time, connectivity, and throughput for individual clients. This allows the administrator to pinpoint issues affecting a specific wireless client, making it a key tool for troubleshooting poor client experience.

SGTs carry group-based policy information in the VXLAN header, allowing the fabric to enforce scalable group-based access control across edge nodes without hop-by-hop ACLs. This satisfies the requirement for group-based policy enforcement that is independent of VLAN or IP subnet boundaries in the SD-Access fabric.

The `ip dhcp pool` command `lease infinite` explicitly configures the DHCP server to assign an address with no expiration time. Because the lease never expires, the client never needs to send a DHCPREQUEST to renew it, and the address remains valid indefinitely. This is a valid configuration that forces the client to keep the same IP for as long as the pool exists, though it can exhaust the address pool if clients move or go offline without releasing.