ENCOR 350-401 (350-401) — Questions 1126–1200

Mismatched MTU sizes break the link's ability to carry full-size frames consistently. A 9000-byte jumbo frame sent toward the 1500-byte interface is dropped or fragmented, causing intermittent packet loss on the LACP port-channel, especially for large transfers.

This command configures the default login authentication method list to try TACACS+ first, then fall back to the local username database if the TACACS+ servers do not respond. The 'local' keyword ensures that local authentication is used as a backup, providing administrative access even when the AAA server is unreachable.

This is the only configuration that actually creates an ERSPAN source session. The 'type erspan-source' keyword puts the session into ERSPAN mode, and the 'source vlan 100' selects the VLAN to mirror while 'destination ip 192.168.1.100' defines the remote IPv4 address of the collector or destination switch. ERSPAN encapsulates the mirrored packets in GRE with an IP outer header, enabling the traffic to traverse a routed Layer 3 network that local SPAN and RSPAN cannot cross.

The statement is correct: for an MPLS L3VPN, the VRF RED configuration itself is valid, but the VRF must also be activated in BGP under the 'address-family ipv4 vrf RED' stanza. This enables BGP to import and export routes between the VRF and the VPNv4 address family, converting IPv4 VRF routes into VPNv4 routes with the appropriate route target extended communities. Without this BGP address-family configuration, the VRF will have no BGP peering for VPN routes, so even if other pieces are in place, end-to-end L3VPN connectivity will not work.

A 401 Unauthorized response means the request lacks valid authentication credentials. RESTCONF uses HTTP authentication, typically basic auth. The engineer must include an Authorization header with the base64-encoded username:password. Even if the credentials are correct, they must be sent in the request. The script likely omitted the auth parameter, causing the server to reject the request. Adding basic authentication resolves the issue.

OSPF sends hello packets every 10 seconds on broadcast multi-access segments such as Ethernet, satisfying the default timer requirement. This interval lets routers detect neighbours quickly while avoiding excessive overhead. It differs from NBMA and point-to-multipoint networks, which default to 30 seconds.

This configuration creates a DHCP pool named POOL1, defines the network and subnet mask, and provides the default gateway and DNS server. The ip dhcp pool command enters DHCP pool configuration mode, where network, default-router, and dns-server are valid commands. This fully satisfies the requirement to provide IP addresses, gateway, and DNS information to clients. It is the correct and standard way to configure a Cisco IOS DHCP server.

PCI passthrough uses an IOMMU such as Intel VT-d to remap the physical NIC's PCIe function directly into the guest's address space, so the VM's device driver owns the entire NIC exclusively. The hypervisor leaves the data plane, eliminating virtual switching and emulation overhead to reach native line-rate throughput. However, this dedicates the NIC to a single VM, so it cannot be shared and live migration is typically unsupported because the device is pinned.

FlexConnect mode allows the access point to switch client traffic locally at the branch while still being managed by the controller. If the WAN link fails, the AP enters standalone mode and continues to serve clients with local switching, meeting the requirement for local forwarding and reduced WAN bandwidth usage. This is the correct choice for branch survivability.

ICMP Echo is the correct choice because it measures round-trip time and reachability to a destination. The engineer can set a threshold of 100 ms and configure a reaction to trigger when the threshold is exceeded, which can then be tracked. This operation type is specifically designed for this purpose.

The healthScore field is a normalised 0-100 metric, so 85 denotes good overall device health, corroborated by overallHealth set to good, 50 percent memory usage and 25 percent CPU usage. It is not a percentage of failed checks.

Rapid PVST+ replaces the timer-based listening and learning states with a proposal/agreement handshake between switches, synchronising port roles quickly. This mechanism drives rapid convergence per VLAN, satisfying the requirement for fast topology reconvergence after a link change.

The Cisco APIC Tenant Traceroute tool allows engineers to trace the path of a specific flow through the ACI fabric, from source to destination. It simulates the flow and shows each step, including policy enforcement points, leaf and spine switches, and any drop or redirect actions. This is ideal for troubleshooting intermittent connectivity issues because it provides visibility into the actual forwarding path and policy application. It helps identify where packets may be dropped or misrouted within the fabric.

This is correct because the ACL contains an explicit deny statement for TCP port 23 (Telnet) with source any and destination any. When a packet matches this entry, the router immediately drops it and does not evaluate any subsequent ACEs. Even though a later entry permits all IP traffic, the sequential and first-match nature of Cisco ACLs ensures the Telnet deny takes precedence. Thus, Telnet from any source, including 192.168.1.0/24, is denied.

YANG modules are versioned with revision dates. A module revision may change between IOS XE releases, and using an outdated or mismatched revision can cause errors. By checking the revision date from the yang-library, the engineer can ensure the script uses the correct model version for the device's software, preventing schema mismatches.

The anycast gateway feature allows multiple leaf switches to share the same virtual IP and MAC address for a subnet's default gateway. This enables hosts to use a consistent gateway regardless of their location, and ensures optimal forwarding without traffic tromboning. Configuring the same virtual MAC on all leaf switches achieves the requirement.

This is the correct interpretation of the show ip pim neighbor output. The table lists exactly three PIM neighbors, and the Mode column identifies the first neighbor (192.168.1.11) as Dense while the other two neighbors (192.168.1.12 and 192.168.1.13) are Sparse. Therefore, Router R9 has three PIM neighbors total, with one in Dense mode and two in Sparse mode, accurately reflecting the per-interface PIM mode configuration.

In Cisco SD-WAN, data policy is applied per VPN and direction. Placing the policy under VPN 0 (the transport VPN) means it only inspects traffic entering or leaving the transport interface, not the service-side traffic from the LAN. Internet-bound traffic from the service VPN (e.g., VPN 10) must be matched by a data policy configured under that specific service VPN. Because the policy was placed in VPN 0, it never matched the LAN traffic, so the local exit was not enforced and the traffic continued toward the hub.

This is the correct upgrade workflow: 'software install add' stages the image onto the device, 'activate' makes it the next boot image, and 'commit' finalizes the change. The entire process triggers a single reboot, which is the intended way to apply NFVIS upgrades while minimizing downtime. This is the only supported method for in-place NFVIS upgrades.

The 'Nbrs F/C' column for Gi0/0, which stands for Fully adjacent neighbors / Count of all neighbors, displays 2/2. This means that R9 has exactly two neighbors on that interface, and both have reached the 'Full' state, indicating fully adjacent neighbors with synchronized link-state databases. Therefore, the statement that R9 has two fully adjacent neighbors on Gi0/0 is a factual conclusion directly supported by the output.

Correct. The output explicitly states the operation type is 'udp-jitter'. This IP SLA operation sends a series of UDP packets with sequence numbers and timestamps to a destination port, then compares send and receive times to calculate one-way delay, jitter, and packet loss. It is commonly used to emulate voice or video traffic and assess network quality for real-time applications.

The 'authentication local rsa-sig' command specifies that the local router uses RSA signatures, which are derived from a certificate, for its own authentication. The 'authentication remote eap query-identity' command instructs the router to request the peer's identity and use EAP for remote authentication, which supports EAP-MSCHAPv2. This combination matches the policy requirements for certificate-based local auth and EAP-based remote auth.

The range keyword in the SPAN session configuration designates GigabitEthernet1/0/1, 1/0/2, and 1/0/3 as multiple source interfaces, all feeding copied traffic to a single destination port, GigabitEthernet1/0/4. Local SPAN explicitly allows multiple source interfaces in one session, and the monitoring port receives a replica of each source's traffic without altering the original forwarding path, making this the correct behavior.

Shutdown mode places the port into an error-disabled state when a violation occurs, effectively shutting it down. It also sends an SNMP trap and syslog message. This matches the requirement to shut down the port and send an SNMP trap. The port can be recovered manually or via errdisable recovery. This is the correct violation mode for the described policy.

On-change subscriptions trigger updates whenever a subscribed leaf changes. Selecting YANG paths containing rapidly fluctuating leafs such as interface counters or CPU load causes near-continuous notifications, driving excessive device CPU usage — precisely the symptom described in the stem.

The show interfaces gigabitEthernet 0/1 command provides detailed information about the interface, including duplex, speed, and error counters. This allows the engineer to confirm the operational duplex mode and detect a mismatch. It is the most direct way to verify duplex settings on a specific interface.

On Ethernet broadcast multi-access networks, OSPF's default hello interval is 10 seconds. This value is defined in RFC 2328 for broadcast and point-to-point interfaces, and the associated dead interval is 40 seconds (4 times the hello). The 10-second hello keeps neighbor adjacency establishment quick while maintaining a reasonable control-plane overhead.

The access-class command is used under line configuration mode to restrict incoming VTY connections based on an ACL. The in keyword specifies that the ACL filters traffic entering the VTY lines. This is the correct way to apply an ACL to management access, ensuring only hosts from permitted subnets can establish SSH or Telnet sessions.

This is the correct configuration. Setting the port to access mode with access VLAN 10 handles the untagged PC traffic, while the switchport voice vlan 200 command tells the switch to recognize 802.1Q-tagged frames for VLAN 200 as voice traffic from the attached IP phone. This is the standard Cisco IP telephony deployment model for a single physical port supporting both a phone and a PC.

Port address translation is enabled by the **overload** keyword, which lets many inside hosts share the single outside address 192.168.1.1 by multiplexing sessions across unique source port numbers. Access-list 100 matches the 10.1.1.0/24 source range, satisfying the requirement to translate all inside traffic to that interface address.

In IKEv1 main mode, MM_NO_STATE is the initial state entered when the IKE SA negotiation is starting but no proposal has been accepted. This state reflects an active attempt: the router is either sending or waiting for main mode packets, and the SA has not yet progressed to later states such as MM_SA_SETUP, MM_KEY_EXCH, or ultimately QM_IDLE. Thus, the tunnel is being built but is not finished, and the negotiation could be ongoing or stalled, but it is definitively not complete.

This configuration is valid for MPLS L3VPN because the VRF RD (route distinguisher) uniquely identifies VRF RED in the MPLS domain, and the export/import route targets define how routes are distributed to other VRFs. Associating the interface with VRF RED via 'ip vrf forwarding RED' ensures that all traffic on that interface is forwarded using VRF RED's routing and CEF tables, not the global table. This is exactly how a customer edge interface is bound to a VPN routing instance in a service provider MPLS VPN deployment.

NETCONF returns data in XML format. To extract specific values, the script must parse the XML. Libraries such as xml.etree.ElementTree or lxml allow navigation of the XML tree. This step is necessary to process the response and retrieve the statistics values for further use.

VRRPv3 is an open standard defined by the IETF and supports both IPv4 and IPv6. It allows multiple routers to share a virtual IP and can be configured for load sharing across groups. Since the scenario requires IPv6 gateway redundancy with an open standard, VRRPv3 satisfies all stated conditions.

GRE is designed to encapsulate a wide variety of protocols, including multicast and broadcast. When you configure a GRE tunnel, it acts like a virtual point-to-point link that can carry multicast traffic, which is essential for routing protocols like OSPF and EIGRP that use multicast hellos. This is a key advantage over IPsec tunnels, which typically only support unicast unless specifically configured with GRE.

MACsec on Cisco switches uses a key chain to store the connectivity association key (CAK) and its lifetime. The key chain is referenced under the interface with the mka key-chain command, and the lifetime controls key rotation. This satisfies the requirement for a preshared key and periodic rotation.

Rapid PVST+ is Cisco's implementation of RSTP that runs a separate instance per VLAN. It incorporates RSTP mechanisms such as edge ports, link-type point-to-point, and proposal/agreement to achieve rapid convergence. This allows per-VLAN topology optimization and fast failover, making it suitable for modern switched networks with multiple VLANs.

Creating a separate guest WLAN mapped to a dedicated interface (e.g., a DMZ VLAN) and applying an ACL that permits only Internet-bound traffic is the standard method for guest isolation. This ensures guest devices cannot reach corporate subnets. The WLC supports this through interface mapping and ACLs applied to the WLAN.

RESTCONF requires the Content-Type header to be application/yang-data+json when sending a JSON payload. Without it, the device cannot determine the payload format and returns 415. Adding this header tells the server the body is YANG data encoded in JSON, allowing it to parse and apply the configuration.

RESTCONF returns the JSON exactly as structured by the YANG module, so the top-level key retains its module prefix. Indexing the interface list, then the ipv4 address list, reaches the ip leaf, matching the nested hierarchy shown in the response.

The output directly shows, for prefix 10.1.1.1/32, a local binding of label 16 and a remote binding advertised by LSR 10.1.1.2:0 with label 17. This satisfies the stem's requirement to interpret the LDP bindings table, confirming both label values and the advertising peer exactly as displayed.

The 'ip dhcp excluded-address' command prevents the router from assigning specific addresses, such as its own interface address, to DHCP clients. It is configured in global configuration mode and can specify a single address or a range. This ensures the router's IP is not leased to other devices.

Setting administrative distance (AD) for redistributed routes is essential because AD determines the trustworthiness of routing sources. When routes are redistributed between OSPF and EIGRP, their default AD values may cause a redistributed route (e.g., an EIGRP external route with AD 170) to be preferred over the original protocol's internal route, leading to routing loops or suboptimal paths. By explicitly setting AD values, you ensure that routes from the original protocol are always preferred, maintaining loop-free and predictable routing behavior.

The SPAN session is configured with source VLANs 10 and 20 and an explicit direction of 'receive only' (Rx). As frames ingress on any port that is an active member of those VLANs, the switch copies them to the destination port Gi1/0/25, while leaving the normal forwarding path untouched. No outgoing or transmitted frames from those VLANs are captured because the monitor direction is limited to ingress traffic.

The output shows State/PfxRcd counts of 15 and 20 for the two neighbors. In BGP's state machine, only the established state populates the PfxRcd column with a numeric prefix count; any other state (Idle, Connect, Active, OpenSent, OpenConfirm) would display the state name or a placeholder. Consequently, both neighbors are fully peering and exchanging reachability information.

PIM-SM builds distribution trees only when receivers signal interest, so it operates as a pull model: the last-hop router sends explicit PIM joins toward the rendezvous point. This satisfies the stem's requirement that receivers explicitly join the group, unlike dense-mode flood-and-prune push behaviour.

HTTP 202 Accepted means the request was validated and queued, not completed. Cisco DNA Center processes discovery asynchronously, returning a task identifier the client polls for status. A 200 would indicate synchronous completion; 202 confirms the discovery is running in the background.

Netmiko builds on Paramiko to handle SSH transport, device prompts, and enable-mode escalation, so a Python script can drive Cisco CLI sessions programmatically. This satisfies the automation requirement by removing manual telnet or SSH interaction, unlike SNMP-based polling libraries.

The command output shows 'Known via bgp 65001' and 'MPLS label: 18', which together confirm that the route was received from a BGP peer in AS 65001 and that an MPLS label has been assigned to the prefix. In BGP labeled unicast or MPLS VPN operation, the label is propagated with the route so that ingress PEs can impose the correct label and forward traffic along the LSP. This is the only option that correctly correlates both the routing protocol source and the MPLS forwarding indicator.

The IP address 192.168.1.10 is associated with SGT 10, and the source column shows SXP. This means the binding was learned dynamically via the Security Exchange Protocol from a peer device that is speaking SXP, rather than being configured locally or derived from authentication events. SXP propagates IP-to-SGT mappings that were originally assigned at an authentication point, allowing downstream devices to perform SGT enforcement without direct authentication. Therefore, this is the correct interpretation of the output.

LACP is an IEEE 802.3ad standard protocol that dynamically negotiates EtherChannel formation between devices from different vendors. It provides increased bandwidth and redundancy by bundling multiple physical links into a single logical link. This meets the requirement for dynamic negotiation and interoperability.

IKEv2 begins negotiation over UDP 500, then detects NAT along the path and switches to UDP 4500, which encapsulates ESP-in-UDP to survive address translation. This satisfies the stem's NAT traversal requirement, since port 4500 allows the encrypted payload to pass through NAT devices that would otherwise drop native ESP packets.

The outbound route-map applies the set community action to every prefix advertised to 10.0.0.2, so the neighbour receives routes tagged 65001:100. Because no send-community keyword is shown, the attribute is set locally but only transmitted if community propagation is enabled.

MP-BGP carries VPNv4 routes between PE routers, with each route tagged by a route distinguisher for uniqueness and a VPN label for forwarding. This exchange populates VRFs across the provider core, satisfying the stem's requirement for a true MPLS Layer 3 VPN statement.

An L2Out connects the ACI fabric to an external Layer 2 network, but by default BUM (broadcast, unknown unicast, multicast) traffic is not automatically flooded through every L2Out. The 'flood on' setting under the L2Out must be explicitly enabled so that BUM frames received in the BD are also sent to the external network; without it, BUM traffic is dropped or handled only locally. Since this L2Out lacks that flood configuration, the L2 extension does not actually extend L2 flooding, which explains the connectivity problem.

Cisco SD-Access is a campus fabric architecture that uses LISP for control plane, VXLAN for data plane, and Cisco TrustSec for group-based policy. It provides centralized management via Cisco DNA Center, automated fabric provisioning, and consistent policy for wired and wireless users, including guest onboarding, which matches the requirements exactly.

IP Source Guard uses the DHCP snooping database to validate source IP and MAC addresses. For static IP addresses, an IP source binding must be manually configured using the ip source binding command. Without this binding, the switch drops all traffic from the laptop because it cannot verify the source, causing complete loss of connectivity.

Multiple BSSIDs operating on the same 2.4 GHz channel create co-channel contention: when two APs' coverage areas overlap on channel 11, all associated stations must contend for the same RF medium via CSMA/CA. The resulting deferred transmissions, hidden-node collisions, and excessive backoff produce high channel utilization, frame retries, and ultimately client disconnects. This directly matches the spectrum analyzer showing sustained energy on channel 11 and the presence of neighboring APs configured to that same channel.

This is correct. In Low Latency Queuing (LLQ), the `priority` command with a bandwidth value creates both a strict priority queue and an implicit policer. This policer strictly limits the traffic served from the priority queue to the configured bandwidth; any voice traffic exceeding that rate is immediately dropped, rather than being queued. This mechanism prevents the priority queue from starving other queues, but it requires that the bandwidth be sized to handle voice bursts. Therefore, the drops are the expected behavior of the policer when the configured rate is too low for the incoming voice traffic.

Because the class map uses match-any, traffic marked with DSCP AF21, AF22, or AF23 is all placed into this class. The 'bandwidth remaining percent 50' command reserves half of the interface's available non-priority bandwidth for that class, and since no priority queue is configured, this effectively gives those AF flows a 50% share of the link when congestion occurs. Traffic that does not match any listed DSCP value falls into the implicit class-default, which is explicitly configured with fair-queue, so all other flows share the remaining 50% fairly.

FlexConnect enables local switching, so the AP bridges client traffic directly onto the access VLAN rather than tunnelling it to the WLC. When the CAPWAP control tunnel drops, clients on that locally switched WLAN retain connectivity and continue forwarding data.

In IKEv1, when a transform set does not explicitly name the HMAC hash algorithm, the router substitutes a built-in default that varies across Cisco IOS versions and platforms—often SHA-1 in older releases but SHA-256 in newer builds. If the two routers default to different hashes, the hash algorithm field in the proposal differs, so the responder cannot find an acceptable transform and IKE SA negotiation fails, even though all explicitly configured parameters match. This is a classic invisible-difference problem because the config appears consistent, but the effective proposal is not.