ENCOR 350-401 (350-401) — Questions 1051–1125

PIM Hello discovers neighbors and maintains adjacency; Join is used to join a multicast tree; Prune is used to leave a tree; Assert resolves duplicate forwarding on a multi-access network; Bootstrap messages are used in PIM SM to distribute RP information.

uRPF verification involves checking CEF tables, interface configuration, and packet statistics. The order ensures systematic troubleshooting: start with global CEF, then interface config, then verification commands.

Flexible NetFlow (FNF) extends traditional NetFlow by allowing user-defined flow records, keys, and non-key fields. It supports multiple flow exporters and can aggregate data using flow caches. FNF is configured using the 'flow record' and 'flow monitor' CLI commands.

The correct order for configuring an IP SLA UDP jitter operation is: first enter global configuration mode (A), then define the IP SLA operation with type udp-jitter (B), then specify the destination IP address and UDP port (C), then schedule the operation using a start-time (D), and finally verify the operation with 'show ip sla statistics' (E).

Static route uses tracking to install or remove a route; HSRP uses tracking to adjust priority; PBR uses tracking to change policy routing; VRRP uses tracking for priority; GLBP uses tracking for weighting.

SSL VPNs use TLS for encryption, can provide clientless access via web browser, and support port forwarding for legacy applications. They do not require IPsec and can use any port (typically 443).

Shaping buffers excess traffic to smooth bursts; policing drops or re-marks excess traffic; shaping uses a token bucket with a queue; policing typically uses a single or dual token bucket without queuing; policing can be applied inbound or outbound.

IntServ uses RSVP for per-flow signaling, DiffServ uses DSCP marking for per-hop behavior, Best Effort provides no guarantees, IntServ requires state in routers, and DiffServ scales well for large networks.

Template deployment starts with creating the template, then associating it with a site, committing the changes, deploying to the target device, and verifying the deployment.

802.11b operates at 2.4 GHz with 11 Mbps; 802.11a operates at 5 GHz with 54 Mbps; 802.11g operates at 2.4 GHz with 54 Mbps; 802.11n operates at both 2.4 and 5 GHz with 600 Mbps; 802.11ac operates at 5 GHz with up to 6.9 Gbps.

IKEv2 consists of only two phases: Phase 1 (IKE_SA_INIT) and Phase 2 (IKE_AUTH). CREATE_CHILD_SA, INFORMATIONAL, and rekey are exchanges that occur within the established IKE SA, not separate phases.

class-map defines traffic classes. policy-map associates class-maps with QoS actions. service-policy applies the policy-map to an interface. class (within policy-map) references a class-map. match (within class-map) specifies classification criteria.

B is correct because BGP selects the best path based on the shortest AS_PATH length when all other attributes (weight, local preference, origin) are equal. In the output, Path #1 has an AS_PATH of '65050 65100' (2 AS numbers) while Path #2 has '65050 65100 65200' (3 AS numbers), making Path #1 the best path. The 'best #1' annotation confirms this selection.

gRPC uses HTTP/2 for transport and Protocol Buffers for serialization. gNMI is a gRPC-based protocol specifically for network management and telemetry. gNMI supports both telemetry subscriptions (Subscribe RPC) and configuration operations (Set, Get). It uses YANG models to define data paths. gNMI does not require NETCONF; it operates independently over gRPC.

All pairs are correctly matched. Note: OpenVZ is not associated with Proxmox VE; Proxmox VE uses LXC containers. The correct mapping for OpenVZ would be to a different vendor, but it is not part of this matching.

The code assumes the API call succeeds and the 'response' list is non-empty. If the token is expired or the API returns an error, response.json() may not have the expected structure, causing a KeyError or IndexError. The code lacks error handling for HTTP status codes and empty responses.

Ansible inventory grouping and variable inheritance follows a hierarchy: first, group variables are defined in group_vars files; then, host variables are defined in host_vars files; next, the inventory parser resolves group parent-child relationships; after that, variables are merged with child groups overriding parent groups; finally, host-specific variables take highest precedence.

The process starts with subscribing to OpenConfig paths, receiving encoded data, decoding it, extracting counters, and finally analyzing the values.

Authentication uses RADIUS; authorization uses TACACS+; accounting uses RADIUS; command authorization uses TACACS+; dot1x authentication uses RADIUS.

The source-interface command ensures that telemetry packets use a consistent source IP address, which helps with firewall rules and receiver identification.

MAC flooding is mitigated by port security, DHCP starvation by DHCP snooping, ARP spoofing by DAI, STP manipulation by BPDU guard, and VLAN hopping by disabling DTP.

The correct order starts with constructing the RESTCONF URI, appending the depth parameter, adding the field parameter, sending the GET request, and finally parsing the filtered JSON/XML response.

The 'passive-interface default' command sets all interfaces as passive, meaning they do not send or receive EIGRP hellos. The 'no passive-interface' command overrides this for specific interfaces.

The process begins when the ingress tunnel router (ITR) receives a packet for a destination EID. The ITR sends a Map-Request to the Map-Server, which looks up the mapping and replies with a Map-Reply containing the RLOC. The ITR then caches the mapping and encapsulates the packet to the egress tunnel router (ETR).

A virtual switch connects to the physical network through uplink ports, which are typically mapped to physical NICs on the hypervisor host. This allows VMs on the virtual switch to communicate with external networks, making option A correct.

The campus design uses a hierarchical model with access, distribution, core layers; SVI provides Layer 3 gateway; VSS virtualizes switches; StackWise combines physical switches; PoE powers endpoints.

The CE device connects directly to the PE and advertises customer routes; the PE device attaches labels and maintains VRFs; the P device is a core router that switches MPLS labels without holding VPN routes; the RR (Route Reflector) distributes VPNv4 routes within the MPLS VPN core; the ASBR connects different MPLS VPN domains.

cisco_ios is for classic IOS; cisco_nxos is for NX-OS; cisco_xr is for IOS-XR; cisco_xe is for IOS-XE.

Change management begins with a request and impact assessment, followed by approval. After implementation, verification ensures success, and finally the documentation is updated to reflect the change.

The correct order is: create the ACL with deny/permit entries, apply it inbound on an interface, then verify with show commands. This follows standard Cisco IOS ACL configuration workflow.

Type 1 hypervisors run directly on hardware (bare-metal), while Type 2 run on a host OS.

NO_EXPORT prevents advertisement outside confederation; NO_ADVERTISE prevents any advertisement; LOCAL_AS prevents advertisement to external peers; INTERNET advertises to all BGP peers.

GET, GETNEXT, GETBULK, and SET are manager-to-agent requests; TRAP and INFORM are agent-to-manager notifications.

VRF-Lite uses only VRFs without MPLS labels; MPLS VPN uses labels for isolation; VRF-Lite is limited to a single router; MPLS VPN scales across the core; VRF-Lite does not require MP-BGP; MPLS VPN uses MP-BGP for VPNv4 route exchange.

AAA configuration requires first enabling AAA globally, then defining the authentication method list, applying it to login, and optionally specifying a fallback method like local. Finally, verify with debug commands.

Summarization on an ABR uses the area range command to aggregate prefixes. The order is: identify prefixes, configure range, verify, and optionally suppress more specific routes.

C is correct because Cisco TrustSec uses Security Group Tags (SGTs) to classify traffic based on user, device, or role, rather than IP addresses. SGTs are 16-bit values (0–65535) assigned dynamically via authentication (e.g., 802.1X) or static mapping, enabling scalable policy enforcement.

224.0.0.0/24 is reserved for link-local multicast; 232.0.0.0/8 is for Source-Specific Multicast; 239.0.0.0/8 is for administratively scoped (private) multicast.

dict maps parameter to value; list stores ordered items; tuple is immutable; set holds unique elements.

When configuring an EtherChannel, the port-channel interface must have the same VLAN configuration as the physical member ports. In this scenario, the physical ports are access ports in VLAN 10, but the port-channel interface was not explicitly configured with the same VLAN. Cisco switches require the port-channel interface to be configured with the same switchport mode and VLAN assignment as the member ports; otherwise, the EtherChannel will remain down because the logical interface does not match the operational state of the physical ports.

AToM pseudowire setup begins with configuring the attachment circuit and VC ID on PE routers, then establishing an LDP targeted session between PEs, then exchanging Label Mapping messages for the pseudowire, then pseudowire status notification, and finally pseudowire operation.

The MPLS label has 4 fields: Label (20 bits), TC (3 bits), S (1 bit), and TTL (8 bits).

The output shows 'P2MP: not advertised', which explicitly indicates that Point-to-Multipoint (P2MP) capability is not supported on this router. All other listed capabilities, including LDP Graceful Restart, MTU Signaling, and Dynamic Capability, are shown as 'advertised' and therefore supported.

uRPF verification involves checking if it is enabled, verifying the routing table, testing with ping, checking counters, and interpreting results. The order follows a logical troubleshooting sequence.

HSRP uses an active/standby model with one virtual MAC; VRRP uses an election process with a single virtual MAC; GLBP load-balances across multiple gateways.

Service chaining steers traffic through a sequence of VNFs; classifiers identify traffic; SFC encapsulation maintains chain context.

The correct order for configuring a site-to-site IPsec VPN is: first define the IKE policy (Phase 1 parameters), then define the IPsec transform set (Phase 2 parameters), then create the crypto ACL to match interesting traffic, then configure the crypto map to bind all parameters, and finally apply the crypto map to the outgoing interface.

Netmiko simplifies SSH to network devices; NAPALM provides multi-vendor abstraction; Nornir is task-based and parallel; Scrapli is async-focused; Paramiko is low-level SSH.

Map-Request queries the location of an EID, Map-Reply provides the mapping, Map-Register registers EID-to-RLOC mappings, Map-Notify confirms registration, and Map-Solicit triggers a Map-Request from the map-server.

The MPLS label is 20 bits, Traffic Class (TC) is 3 bits, Bottom of Stack (S) is 1 bit, and TTL is 8 bits, totaling 32 bits per label entry.

SNMPv3 provides both authentication and encryption. The authNoPriv level uses MD5 or SHA for authentication without encryption; noAuthNoPriv uses no security; authPriv provides both authentication and encryption. The engine ID is required for SNMPv3 user configuration and is used to generate the localized key.

CoPP configuration requires defining match criteria in a class-map, then creating a policy-map with police commands, and finally applying the policy to the control plane. The order follows standard MQC (Modular QoS CLI) process.

Policy application starts with defining match criteria (prefix-list or AS-path ACL), then creating a route-map with permit/deny and set actions, applying it to a neighbor, and finally verifying the policy effect.