ENCOR 350-401 (350-401) — Questions 1201–1275

A guest anchor controller is a dedicated WLC that handles guest traffic separately from the corporate network. Guest clients are tunneled from the foreign controller to the anchor controller, which typically resides in a DMZ. This provides isolation and ensures that guest traffic only has internet access, not corporate network access. This is the standard design for guest wireless.

For dynamic VLAN assignment, the RADIUS server must return the standard IETF attributes: Tunnel-Type set to VLAN, Tunnel-Medium-Type set to IEEE-802, and Tunnel-Private-Group-ID containing the VLAN ID or name. The switch interface must be configured for 802.1X and typically in access mode so that the port can be moved to the assigned VLAN upon authentication. This is the correct combination to meet the requirement.

The management interface on a Cisco 9800 Series Wireless Controller is used for out-of-band management, including device access via SSH, HTTPS, and SNMP. It must be configured with an IP address, subnet mask, and default gateway. This interface is separate from data interfaces and is essential for administrative access to the controller.

This is the intended behavior. The 'frequency 10' command configures the interval between ICMP echo probes to 10 seconds. 'start-time now' begins the operation immediately upon activation, while 'life forever' sets no termination timestamp, so the probe runs continuously until manually stopped or the device reloads, providing long-term reachability and RTT monitoring.

The local switch should be configured with 'lacp system-priority 100' to make it the controlling switch in the LACP negotiation. LACP uses the system priority value, combined with the switch's MAC address, to form the system ID; the lower numeric system priority is treated as higher priority, so a value of 100 (rather than the default 32768) ensures the local switch wins the election. The controlling switch makes the final decision on which physical ports are bundled into the port-channel, so this is the correct way to configure control.

The EIGRP interface output reports Mean SRTT (Smoothed Round-Trip Time) of 15 ms on Gi0/1 versus 12 ms on Gi0/0. A higher SRTT indicates a longer measured round-trip delay to the EIGRP neighbor, meaning Gi0/1 experiences higher latency. This is a direct metric for delay, not merely a configured value, so the conclusion is correct.

Cisco SD-WAN centralizes configuration and policy in vManage, which pushes feature templates and centralized policies to vEdge and cEdge devices. This enables consistent, scalable provisioning of thousands of branches without manual CLI configuration. It directly supports the architect's goal of managing branch-to-data-center and cloud connectivity in a unified, policy-driven manner across the overlay.

The Cisco Embedded Wireless Controller is a feature on Catalyst 9000 switches that provides integrated wireless controller functionality. It allows the switch to manage access points directly without needing an external WLC. This meets the requirement for centralized control and AP management. Enabling this feature allows the switch to act as a wireless controller, simplifying the deployment and reducing hardware footprint.

The show processes cpu history command displays a graphical representation of CPU utilization over the past 60 seconds, 60 minutes, and 72 hours. This helps correlate high CPU with specific events or times, such as a spike during a network storm or a scheduled task. It provides historical context that can identify patterns and narrow down the cause of sustained high CPU.

vSmart is the controller that implements control plane policies and distributes routing information via the Overlay Management Protocol (OMP). It maintains the centralized control plane and pushes policies to vEdge devices. This is essential for SD-WAN fabric operation.

In ACI, the leaf switch acts as the policy enforcement point, translating contracts into hardware ACL and forwarding rules applied to the EPG interfaces. When a contract permitting TCP 443 is attached between EPGs, the leaf enforces that filter for traffic between them, which is exactly the construct required.

Standard ACLs match only on the source IPv4 address, so they cannot distinguish destination, protocol or port. This limited matching capability is the defining constraint that separates standard ACLs from extended ACLs on Cisco IOS.

WPA2 Personal uses a pre-shared key (PSK) for authentication and AES for encryption. It does not require an external authentication server, meeting the requirement. This is suitable for small to medium networks where a shared key is acceptable and simplifies deployment.

In a multicast-based VXLAN fabric, each VNI is mapped to a multicast group address. VTEPs that have the VNI configured join that group via IGMP. When a VTEP needs to send BUM traffic for that VNI, it sends the VXLAN-encapsulated packet to the multicast group, and all VTEPs in the group receive it. This mapping is configured on each VTEP.

This is correct because the trunk's allowed VLAN list permits VLANs 1-1005, but the VLAN database only has VLANs 1, 10, and 20 in an active/up state (for instance, 'Status: active'). VLANs 2-9 are therefore permitted on the trunk but are not active, so they will not carry traffic until they are created and brought up, or until ports are assigned to them. Being allowed on a trunk does not make a VLAN operationally active; the VLAN must exist and have an active administrative state.

This is correct because high host memory usage triggers the hypervisor's memory-reclaim mechanisms, such as ballooning or swapping out guest pages, to free memory for other workloads. When the vFW's memory is inflated or its pages are swapped, the guest OS may have to fault pages back in, adding significant latency to its data-plane processing. This increased latency can cause the vFW to drop packets because it cannot process traffic fast enough, even though the vFW's own memory usage appears normal from inside the guest.

Multi-authentication (also called multi-auth) allows multiple devices on a single port to be authenticated independently, each receiving its own authorization result. With a phone and a daisy-chained PC, the phone can authenticate via 802.1X into the voice VLAN and the PC can authenticate via MAB or 802.1X into the data VLAN. This is the Cisco feature designed for this exact topology.

On Cisco Catalyst 9100 series APs and similar modern platforms, each radio (2.4GHz, 5GHz, and 6GHz on Wi-Fi 6E) supports up to 16 WLANs simultaneously. This is a per-radio limit, so an AP with two radios can support 32 distinct SSIDs when split across bands, though each WLAN typically maps to a single SSID. The IOS XE wireless controller allows configuration of 16 WLANs per radio interface.

The neighbor states FULL/DR, FULL/BDR, and 2WAY/DROTHER are only possible on OSPF network types that perform DR/BDR election, such as broadcast or NBMA. On a broadcast multiaccess network like Ethernet, OSPF elects a DR and BDR to reduce adjacencies, and DROTHER routers remain in 2WAY with each other. The router's output clearly shows a neighbor as the DR and another in the DROTHER state, confirming the network type is broadcast.

RSVP-TE is the signalling protocol that establishes label-switched paths and reserves bandwidth along an explicit route, satisfying the stem's requirement for a true MPLS-TE statement. It carries the explicit route object and reservation parameters, distinguishing MPLS-TE from plain label distribution.

The Ingress Policy Enforcement Point (Ingress PEP) is the device where traffic enters the TrustSec domain. It is responsible for classifying the traffic and tagging the packet with the appropriate Security Group Tag (SGT). This tagging allows subsequent devices to enforce policies based on the SGT without reclassifying the traffic. The Ingress PEP is typically a switch or router that supports TrustSec.

Correct: VDCs provide administrative and management isolation.

RF statistics for the client, such as RSSI, SNR, and channel utilization, are available in Client 360. These metrics help determine if the disconnections are due to poor signal quality, interference, or coverage gaps. By analyzing RF trends over time, the engineer can correlate disconnects with RF conditions.

This command is correct because on Catalyst switches the default queue assignment for output traffic is based on the CoS value in the 802.1Q header. By modifying the CoS-to-queue map, you can explicitly assign voice (typically CoS 5) to a strict-priority queue and video (e.g., CoS 4) to a separate standard queue, thereby preventing inter-class contention. The command takes precedence over any default mapping and gives the engineer deterministic control over which hardware queue each marked packet uses.

In Cisco SD-Access, the recommended underlay for a Fabric-enabled campus is IS-IS, which is automatically configured by the fabric provisioning workflow through Cisco DNA Center. IS-IS supports fast convergence and ECMP, and the automated deployment minimizes manual configuration on intermediate underlay switches, matching the stated requirement for minimal configuration.

CoPP classifies control-plane-bound traffic using ACLs, which match packets destined to the router itself, such as routing protocols and management traffic. These ACL matches feed the class maps that define which traffic the policy subsequently rate-limits.

On OSPF broadcast multi-access networks such as Ethernet, the default hello interval is 10 seconds, and the associated dead interval is 40 seconds (four times the hello). This is the standard value defined in RFC 2328 for broadcast and point-to-point network types, ensuring timely neighbor discovery and liveness detection without excessive control-plane overhead. Because both routers must agree on the hello interval to form an adjacency, the Ethernet default of 10 seconds is the correct answer.

Cisco DNA Center Assurance leverages streaming telemetry to gather near real-time data from network devices. This allows for continuous monitoring and rapid detection of issues. Streaming telemetry is more efficient than polling and provides granular data for analysis. This is a key feature of Assurance.

WPA2-PSK with AES-CCMP is the appropriate choice because it offers robust wireless encryption (AES in counter mode with CBC-MAC) and uses a pre-shared key for straightforward authentication. This configuration is widely supported, passes PCI DSS requirements for strong encryption, and fulfills the stated requirement of using AES-based security. It balances compatibility with strong protection.

Cisco ISE assigns an SGT to an endpoint as part of the authorization policy after successful authentication. This SGT represents the endpoint's role or group. The switch then uses this SGT in conjunction with SGACLs to enforce role-based access control. This is a fundamental part of Cisco TrustSec.

The 2WAY state confirms that R6 and 1.1.1.1 have exchanged Hello packets that include each other's Router ID, making them OSPF neighbors. However, 2WAY is only a preliminary step; a full adjacency (FULL) requires an exchange of Database Description packets, Link-State Requests, and Link-State Updates to synchronize their OSPF link-state databases. Moreover, on broadcast multi-access networks, a router forms FULL adjacencies only with the DR/BDR, so two non-DR routers can remain in 2WAY without ever reaching FULL. Thus, being neighbors does not guarantee a full adjacency exists.

Hosts with static IP addresses do not appear in the DHCP snooping binding table, so DAI would drop their ARP packets. Creating a static ARP ACL and applying it to the DAI configuration with the arp access-list command allows those specific IP-to-MAC mappings to be validated. This ensures legitimate static hosts are not blocked while spoofing remains prevented.

This command correctly sets the loopback0 interface as the source for VXLAN tunnels on the NVE interface. In Cisco NX-OS, under interface nve1, the 'source-interface loopback0' command designates the loopback interface whose IP address will be used as the source IP in the outer IP header of VXLAN encapsulated packets. This is essential for VTEP reachability and tunnel establishment.

GLBP is a Cisco-proprietary First Hop Redundancy Protocol that provides both redundancy and load sharing. It uses an Active Virtual Gateway (AVG) and up to four Active Virtual Forwarders (AVFs). The AVG assigns virtual MAC addresses to each AVF, and hosts are distributed across the AVFs for load balancing. Failover is sub-second, and if an AVF fails, another AVF takes over its virtual MAC address.

The Cisco IOS DHCP server assigns a default lease duration of 86,400 seconds, which is exactly 24 hours or one day. This lease time is used for any pool where the lease command is not explicitly configured. Because the question asks for the default lease, 1 day is the correct answer.

This is the correct configuration. It sets the maximum number of secure MAC addresses to 2 and also specifies the violation action as 'shutdown'. When a third MAC address attempts to use the port, the switch places the interface in an err-disabled state, which completely disables the port and blocks all traffic, satisfying the requirement to disable the interface upon a violation.

Netmiko wraps Paramiko to abstract per-vendor SSH prompts, handling login credentials, enable mode and prompt detection so scripts need not manage raw channels. This satisfies the stem's requirement for simplified SSH session establishment and authentication against Cisco devices.

Restricting VTY access with an ACL to trusted management subnets and disabling Telnet via transport input ssh prevents unauthenticated or cleartext management from untrusted networks. This directly addresses the goal of protecting the router's management plane from the internet and is a standard hardening step on Cisco IOS-XE edge devices.

This is correct because the output contains two decisive statements: 'Queueing on output: Weighted Fair Queueing' and 'Number of queues: 256'. The first confirms the active output scheduling is WFQ, while the second specifies the number of dynamic queues used for flow classification. WFQ separates packets into conversations based on flow characteristics (source/destination address, ports, protocol, ToS) and schedules them fairly so that interactive flows are not starved by high-bandwidth bulk transfers. The default WFQ uses 256 queues (or a power of two), which matches the output.

SD-Access uses a fabric with VXLAN encapsulation and Cisco Identity Services Engine (ISE) for policy, enabling consistent security and automation across wired and wireless. It provides a single policy plane and reduces manual configuration through fabric provisioning, matching the requirement for unified policy and minimal manual effort.

2-Way is declared once each router sees its own Router ID listed in the neighbour's Hello packet, proving two-way reachability. This bidirectional confirmation is the defining mechanism of the state, so the statement accurately describes when it is reached.

The DHCP binding table displays two entries, each with an IP address, client identifier, and a lease expiration time in the future. Active leases are defined as bindings that are currently assigned and not expired; both entries meet this criterion. This indicates the server has successfully leased addresses to two clients.

In a VXLAN EVPN fabric, BGP is used as the EVPN control plane. The spine and leaf switches must be configured with the EVPN address family (address-family l2vpn evpn) to exchange EVPN routes. This allows the fabric to learn MAC addresses and IP addresses dynamically, reducing the need for flooding. Without BGP EVPN, the fabric would rely on data plane learning, which is less efficient. Thus, this statement is true for Nexus 9000 VXLAN EVPN configuration.

This command specifies that if the RADIUS server becomes unreachable, the port will be authorized into VLAN 10, providing restricted access. It is used within 802.1X configuration to define fallback behavior when the authentication server is dead, ensuring that endpoints can still gain limited network access according to policy.

BGP session teardown with low CPU indicates the policer is dropping BGP keepalives before they reach the control plane. Raising the committed information rate for the BGP class and explicitly permitting that class in the control-plane policy allows the protocol traffic to pass at the required rate, restoring adjacency stability without disabling CoPP for other traffic.

For UDP jitter operations, the destination router must have the ip sla responder command enabled to provide accurate measurements. The responder allows the destination to timestamp incoming packets and return them, enabling the source to calculate jitter and packet loss. Without it, the operation may still function in some cases, but the responder is required for precise jitter and loss statistics, making this statement correct.

This command configures inter-area route summarization for OSPFv3 on the ABR. The 'area 1 range' command tells the ABR to advertise a single summary route for the specified prefix into other areas. It must be configured under IPv6 router OSPF configuration mode. This is the correct way to summarize OSPFv3 routes between areas.

The area filter-list command on an ABR filters type 3 summary LSAs entering or leaving an area, directly and proactively reducing the number of LSAs in area 0's link-state database. Only type 3 LSAs that describe inter-area prefixes are affected, so selected routes are omitted from the ABR's summary advertisements without disrupting the backbone's transit role or intra-area operations. This is the only option that reduces LSDB size while maintaining correct OSPF design.

Correct because this command sets the trust state to CoS on a switch port.

The subtree filtering capability allows the client to specify a filter that selects only the desired subtrees of the configuration data. By using a subtree filter, the engineer can request only the interface description and IP address, reducing the response size and processing. This is the standard way to filter NETCONF responses.

Granular classification lets the engineer allocate adequate bandwidth to OSPF, BGP, and SSH while policing less critical or malicious traffic more aggressively. The default class should be configured to not drop, or to drop only after all classified traffic is serviced, so that unclassified but legitimate control plane packets are not silently discarded and routing or management sessions remain stable.

VRF leaking allows routes to be selectively imported and exported between VRF instances, enabling controlled communication while maintaining isolation for other traffic. This is the standard method to allow specific inter-VRF communication on Cisco IOS-XE routers without merging the routing tables entirely.

Restrict mode drops the offending frames, sends a syslog message, and increments the violation counter, while keeping the port up. This matches every requirement: no shutdown, no admin intervention, and full auditing. It is the standard choice when visibility into violations is needed without disrupting the port.

A centralized data policy must be explicitly attached to a site list and a VPN list to define where it is enforced. If the policy is attached to the wrong site list (or wrong VPN list), vSmart may still distribute it, but the vEdge routers in the intended sites will never apply it to the relevant traffic. This is exactly the kind of configuration error that lets a policy appear present yet have no effect.

In Cisco TrustSec, ISE authenticates the user via 802.1X and returns an authorization result that includes the SGT. The access switch enforces that result by tagging the user's traffic with the assigned SGT. This classification at the access layer is what allows downstream devices to enforce group-based policies. ISE provides the identity-to-SGT mapping, and the switch applies it.

When a QoS policy is applied on a Cisco IOS-XE device, the operational output—such as 'show policy-map interface'—does not update instantly; the device takes a short period to propagate the configuration into its internal data structures and hardware abstraction layer. The test script pushes the configuration and immediately parses the output without any sleep, wait, or polling loop, so the verification runs before the policy is fully reflected. Adding a delay (for example, 'time.sleep(5)' or a Genie 'learn' with a 'sleep' argument) or implementing a retry loop would give the device time to converge and allow the test to pass.

The Mode field displays 'B', which is the Cisco IOS indicator for Bidir-PIM. Bidir mode requires a DR election on multi-access networks to forward multicast traffic toward the RP, and here the DR flag is present, confirming that the interface is participating in that election. Since the B flag is specifically reserved for Bidir operation and is not used by any other PIM mode, this is the correct match.