ENCOR 350-401 (350-401) — Questions 1276–1350

The vSmart controller holds the centralised control plane: it peers with every edge device over DTLS and advertises OMP routes, policies and TLOCs, so edges never need full-mesh routing adjacencies. This satisfies the stem's requirement for a true control plane component statement.

For OSPF MD5 authentication to succeed, both routers must have the same key ID, the same key string, and the same authentication type configured for the area or interface. The area authentication command enables MD5 for the area, and the interface command provides the key. If any of these parameters differ, the neighbor relationship will not form.

Ansible's check mode (--check) allows the playbook to run without applying changes, reporting what would be modified. This supports peer review and drift detection. The ios_config module can compare the running configuration against the desired lines and indicate differences. This aligns with infrastructure as code principles by enabling safe validation before actual deployment, making it the correct choice.

VXLAN provides Layer 2 extension over a Layer 3 underlay by encapsulating Ethernet frames in UDP/IP. BGP EVPN is used as the control plane to advertise MAC and IP reachability, enabling efficient forwarding and multi-tenancy. This matches the requirement for a protocol that encapsulates Layer 2 frames in IP and uses EVPN for MAC/IP advertisement.

Client 360 provides a comprehensive view of a specific client's experience, including onboarding, connectivity, and application performance. It shows the path taken through the network, including switches and access points, and highlights issues like onboarding failures or poor signal quality. This is the ideal tool for troubleshooting individual client performance.

The 'Prefixes: 3' field in the neighbour detail output reports the number of prefixes the neighbour has advertised to this router. It reflects inbound advertisements from that EIGRP neighbour, not routes R1 itself is advertising.

Spine-leaf is correct because it structurally guarantees equal-cost multipath (ECMP) between any pair of leaf switches: every leaf is exactly one hop from every spine, so all available spine-to-spine links are equally weighted. This allows flow-level load balancing across all spine links simultaneously, maximizing bisectional bandwidth for east-west traffic. Unlike three-tier designs that rely on spanning-tree-computed forwarding paths, spine-leaf leverages Layer 3 ECMP, which also ensures consistent low latency and no idle redundancy links.

To forward multicast traffic over a GRE tunnel, multicast routing must be enabled on both the tunnel interface and the physical interface that carries the tunnel. The tunnel interface must be included in the multicast routing configuration (e.g., 'ip pim sparse-mode'). Otherwise, multicast packets will not be forwarded into or out of the tunnel.

Correct because UplinkFast is a proprietary Cisco feature designed for legacy 802.1D PVST+ to quickly fail over to a precomputed alternate root port when the primary uplink fails. However, UplinkFast is mutually exclusive with Rapid PVST+/RSTP, and when enabled it forces the switch to fall back to the classic Spanning Tree Protocol algorithm. That legacy mode relies on Max Age (20 seconds) and Forward Delay (15 seconds) timers, so after a root port failure the switch takes 30–50 seconds to converge instead of milliseconds, matching the behavior described.

CPU pinning binds the vRouter's vCPUs to dedicated physical cores, and CPU reservation guarantees those cycles are not reclaimed by other VMs. Together they prevent the hypervisor scheduler from starving the vRouter during traffic spikes, avoiding packet drops.

For dynamic VLAN assignment, the RADIUS server must send specific attributes in the Access-Accept message: Tunnel-Type (VLAN), Tunnel-Medium-Type (802), and Tunnel-Private-Group-ID (the VLAN ID). These attributes tell the switch which VLAN to assign to the port. Without these attributes, the switch cannot dynamically place the user into the correct VLAN.

IP Source Guard permits traffic only when the packet's source IP matches an entry in the DHCP snooping binding table for that port, dropping spoofed addresses. This binds source IP to switch port and MAC.

The aggregate-address command with the summary-only keyword creates an aggregate route in the BGP table and, crucially, suppresses advertising all more-specific component routes to BGP neighbors. This reduces route-table size and the number of BGP updates while still ensuring reachability via the aggregate. Without summary-only, the aggregate is advertised alongside the specific routes, so the explicit summary-only keyword is required to achieve full suppression.

EVPN Type-3 (Inclusive Multicast Ethernet Tag) routes advertise the originating VTEP's loopback IP address along with the VNI and Ethernet tag information. Receiving VTEPs build an ingress replication list from these advertisements, allowing them to replicate broadcast, unknown-unicast, and multicast traffic to every remote VTEP in the same VNI. This is exactly the control-plane mechanism the design requires.

RESTCONF requires the payload to conform to the YANG model. If the JSON structure does not match the expected hierarchy, such as missing the 'ietf-interfaces:interface' container or incorrect nesting, the device will reject it with HTTP 400. This is the most likely cause. The engineer must ensure the payload follows the YANG model exactly.

The <lock> operation is used to lock a datastore, preventing other sessions from modifying it. The <target> element specifies which datastore to lock, in this case <running/>. This ensures exclusive access for the session. The lock must be released with <unlock> after changes are made. This is the correct operation to prevent concurrent modifications.

The neighbor entry shows that 1.1.1.1 has an interface address of 192.168.1.1 and is in the FULL state. On the same line, the BDR field lists 192.168.1.1, which means this neighbor occupies the Backup Designated Router role for this multi-access segment. Because the BDR is the router that takes over if the DR fails, and the output explicitly assigns that address to this router, it is correct to conclude that 1.1.1.1 is the BDR.

Implementing multiprocessing or multithreading allows the Python script to open SSH sessions to multiple routers simultaneously, dividing the 500-device workload across parallel workers. This dramatically reduces total wall-clock time, because network latency and device response delays overlap rather than accumulate. Using a ThreadPoolExecutor or multiprocessing pool with appropriate concurrency limits (e.g., 20-50 workers) can bring total runtime well under the timeout while preserving Netmiko's robust CLI interactions.

BGP peering drops during route churn because the policer for the BGP class is too aggressive and is dropping legitimate control plane traffic. Adjusting the rate for the BGP class preserves protection for other traffic while allowing BGP keepalives and updates to pass. SSH and SNMP are unaffected because their classes have separate policers, so the fix should target the BGP class specifically.

The correct interpretation is that the policy-map applies a police command to the class containing ICMP traffic destined for the control plane, setting a committed information rate (CIR) of 8000 bps. The conform-action transmit allows traffic within the rate, while the exceed-action drop causes any excess ICMP packets to be discarded, so the net effect is a hard rate limit on ICMP control-plane traffic.

BGP keepalives are small but time-sensitive; if the policed rate for the BGP class is too low, drops cause peer resets. Increasing the conform rate for that class and ensuring BGP traffic matches its dedicated class before falling into the default class restores keepalive delivery while still rate-limiting other unwanted traffic. This preserves control-plane protection without harming BGP.

The routing table line states 'Known via ospf 1' and includes the route tag 'type inter area', which is unambiguously how Cisco marks OSPF inter-area routes. These routes are propagated between areas via Type 3 summary LSAs, and the ABR advertises the prefix into the current area. This matches the 'inter area' classification exactly, making the route an OSPF inter-area route.

This option is correct. In Cisco IOS, the EIGRP `network` command requires a dotted-decimal wildcard mask to define the inverse of the subnet mask; for example, `network 192.168.1.0 0.0.0.255`. If the wildcard mask is omitted, the CLI parser rejects the command as invalid, and the playbook task fails with a configuration error, so no EIGRP network is advertised.

In MPLS L3VPN, route targets (RTs) are BGP extended communities that control the redistribution of VPN routes between VRFs. The exporting PE attaches an export RT to a VPNv4 route; the importing PE only places that route into a VRF if the route's RT matches the VRF's import RT. In this scenario, PE1's export RT does not match PE2's import RT, so even though the VPNv4 route reaches PE2 via BGP, it is not installed in the VRF routing table, leaving the prefix unreachable.

CoPP allows the engineer to police traffic destined to the control plane, including ARP packets. By creating a class-map that matches ARP and a policy-map that sets a rate limit of 500 pps with a drop action, the switch CPU is protected from excessive ARP. This is the correct feature for rate-limiting control-plane traffic.

MACsec encryption is defined by IEEE 802.1AE, which specifies hop-by-hop encryption of Ethernet frames. Key agreement and mutual authentication are provided by MACsec Key Agreement (MKA), which is defined in IEEE 802.1X-2010. The two switches exchange MKPDUs to negotiate a secure association key, so no frames are forwarded in the clear before the session is established, satisfying the mutual authentication requirement.

A standard HyperFlex cluster with UCS Manager-managed fabric interconnects lets the HyperFlex installer discover and configure the fabric interconnects, server policies, and VLANs automatically. This matches the requirement for automated configuration of both fabric interconnects and UCS servers in a data-center cluster, which is exactly what the standard deployment model delivers.

This option is correct: tunnel mode ipsec ipv4 creates a static VTI (Virtual Tunnel Interface), which is a route-based IPsec VPN interface. All traffic routed into this tunnel gets encrypted and encapsulated directly into IPsec using the parameters defined in the referenced IPsec profile. Unlike GRE, a VTI has no extra GRE header, and unlike a crypto map, it allows routing protocols and policy-based routing to decide what to protect, making it a clean, scalable site-to-site VPN solution.

Multi-Domain Authentication (MDA) allows both a data device (PC) and a voice device (IP phone) to authenticate on the same switch port. The phone authenticates in the voice domain, and the PC authenticates in the data domain. This is the correct feature for this scenario because it separates the authentication domains and supports the typical IP phone with a PC attached.

WPA3 authentication relies on a specific AKM, SAE (Simultaneous Authentication of Equals), which must be explicitly declared in the WLAN security profile. The CLI snippet lacks the 'security wpa3 akm sae' command, meaning the controller has no key management agreement to present to WPA3 clients. Without a defined AKM, the WPA3 encryption suite cannot negotiate session keys, so the WLAN remains non-functional for WPA3-capable devices even though other parameters like SSID and VLAN are correct.

Centralised control policy only takes effect on vEdge routers matched by its site list and VPN list. If those references are missing or mismatched, the vSmart distributes nothing to those branches, so they fall back to default best-path selection despite being connected.

GigabitEthernet0/3 is the correct alternate port because its port state is shown as Altn BLK, indicating it is blocked but has received a superior BPDU from another switch. This gives a different path to the root bridge than the root port, so it will transition to forwarding if Gi0/1 fails.

Classification examines packet header fields, and an ACL matches source IP address, destination port, or protocol type, so traffic can be sorted into classes before marking. This satisfies the stem's requirement for a header-based classification mechanism.

For WPA2-Enterprise with 802.1X, the WLAN's Layer 2 Security must be set to WPA2 with 802.1X. Layer 3 Security should be set to None because 802.1X handles authentication at Layer 2. This configuration enables the WLC to use the RADIUS server for authentication.

This is the default CoS-to-queue assignment on many Cisco Catalyst switches, where the eight CoS priorities are paired: CoS 0-1 map to queue 1, CoS 2-3 to queue 2, CoS 4-5 to queue 3, and CoS 6-7 to queue 4. This pairing reflects the hardware's four egress queues and allows differentiated treatment for traffic classes while preserving the eight CoS fields. In this default configuration, queue scheduling (typically SRR) uses these pairs to allocate bandwidth without requiring custom QoS policy.

In Cisco's hierarchical QoS, 'priority level 1' and 'priority level 2' create separate strict-priority queues. The scheduler empties level 1 before level 2, so voice is always sent before video, even if video's policed rate were higher. Both levels are independently policed to their configured rates; excess traffic is dropped or optionally re-marked. This is valid on platforms such as the ASR 1000 that support multiple priority levels.

In an MPLS Layer 3 VPN, the CE router exchanges routes with the provider PE router using eBGP. Redistributing the branch LAN prefix into BGP advertises it to the PE, which places it into the correct VRF and propagates it across the provider backbone to other sites in the same VPN. This keeps the branch routing table simple because the CE only needs a default or summarized route toward the PE.

This applet uses a syslog event detector that matches the OSPF adjacency change syslog message. When the router logs a %OSPF-5-ADJCHG message, the EEM applet triggers. This is a common method to monitor OSPF neighbor state changes without polling. The pattern must match the exact syslog text, and the tag is used to associate actions.

VXLAN uses MAC-in-UDP encapsulation with the standard destination UDP port 4789. The original Ethernet frame is carried inside the UDP payload, allowing Layer 2 segments to be stretched across a Layer 3 underlay. This is a defining operational characteristic of VXLAN and is accurate for this fabric design.

The RP's source is shown as 'via bootstrap', which is the standard output when a router receives RP information from the BSR protocol defined in RFC 5059. BSR uses a designated bootstrap router to flood RP-set information throughout the PIM domain, allowing all routers to dynamically learn the active RP. The command 'show ip pim rp mapping' or similar would display this exact phrase for BSR-learned RPs, confirming that BSR is the correct mechanism.

This configuration includes 'aaa authorization network default group radius', which is necessary for the switch to authorize the user and apply VLAN assignment from the RADIUS server. The authentication command verifies credentials, while authorization processes the returned attributes such as tunnel-type, tunnel-medium, and tunnel-private-group-id to assign the VLAN. The RADIUS server and dot1x system-auth-control are also correctly configured.

OFDMA (Orthogonal Frequency-Division Multiple Access) is a key feature of Wi-Fi 6 that allows multiple clients to be served simultaneously within the same channel by allocating subsets of subcarriers. This improves airtime efficiency and reduces overhead in high-density environments by enabling parallel transmissions to multiple clients. In an auditorium with many concurrent clients, OFDMA significantly enhances capacity and performance.

Disabling SSL certificate verification with verify=False means the client accepts any certificate presented, including a forged one from a man-in-the-middle. This allows an attacker to intercept, decrypt, and modify traffic between the script and the DNA Center API, exposing credentials and data. In production, certificates should be validated against a trusted CA or internal enterprise CA. This is the most direct and exploitable security flaw in the script as written.

SDN controllers compute and program forwarding paths, letting NFV orchestration steer traffic dynamically between VNFs without manual configuration. This satisfies the stem's requirement that NFV can leverage SDN to create and manage network paths between virtual network functions.

CRC errors on a copper Ethernet link indicate that the receiving interface detected frames whose cyclic redundancy check did not match the computed value, which is almost always caused by electrical signal corruption. A faulty or low-quality cable (e.g., damaged pairs, improper termination, or crosstalk) introduces bit errors that corrupt the frame at the physical layer. This directly explains why the AP's wired uplink shows CRC errors while the rest of the switch port statistics appear normal.

This is correct because role-based enforcement in Cisco TrustSec depends entirely on the switch having a valid SGT mapping for the traffic source. If the SGT is not propagated via CTS/SXP/RADIUS or manually configured as an IP-SGT mapping, the switch cannot determine which SGT to assign to the hosts' traffic. Without that mapping, packets remain untagged or are assigned a default SGT, and the role-based ACL (RBACL) is never applied, so the expected drop does not happen. The root cause is the missing SGT propagation or mapping on the switch, not the interface mode.

SXP is a control-plane protocol that propagates IP-to-SGT mappings to devices that cannot perform inline tagging, such as older switches or firewalls. It allows SGTs to be shared across network boundaries, enabling enforcement on devices that lack hardware support for inline tagging. This is a standard method for SGT propagation in TrustSec.

Without a view clause, the group has no MIB access rights, so the agent silently drops or rejects the NMS's authenticated requests despite valid SHA/AES credentials. Other devices succeed because their groups map to views permitting read access, satisfying the walk requirement.

FlexVPN relies exclusively on IKEv2 for tunnel negotiation, unlike legacy DMVPN deployments that commonly use IKEv1. This satisfies the stem's requirement for a true FlexVPN statement, since IKEv2 provides the mandatory key exchange underpinning its unified configuration model, native redundancy, and per-peer policy flexibility.

The AS_PATH attribute in the output lists '65050', indicating that the route's origin is AS 65050 and that this prefix was advertised across the AS boundary from that autonomous system. Additionally, the route is flagged as 'best', meaning it has survived all tie-breaking steps in the BGP best-path selection algorithm and will be installed in the routing table. This combination of the correct origin AS and the 'best' flag makes this the only accurate statement.

This is the correct interpretation of the output. The VOICE class, which likely uses a class-map matching DSCP EF, shows 0 packets in the 'show policy-map interface' output, meaning no traffic has been classified into that class. This could be because voice traffic is absent, is not marked with DSCP EF at the source, or the match statement is misconfigured. As a result, the QoS actions (like police) inside the VOICE class have never been triggered.

In NFVIS, service chaining defines an ordered data path that steers traffic through a sequence of VNFs at the virtual switch level, so placing the vWAAS between the two VNFs ensures it inspects and optimizes traffic without requiring any routing changes inside the VNFs themselves. This is the native, supported method because NFVIS uses service chain rules to redirect traffic between the VNF's virtual interfaces, making the vWAAS operate as an inline service node. Configuring routes or policies on the VNFs would not provide the same guaranteed, ordered traffic steering and would be operationally cumbersome.

The output line "Frequency (seconds): 60" directly states the interval at which the icmp-echo probe to 192.168.2.10 repeats, satisfying the stem's request for the operation's frequency. Frequency governs how often each cycle restarts, distinct from the 5000 ms timeout and threshold values shown.

Active is the correct choice because LACP Active mode proactively initiates the EtherChannel negotiation by sending LACP packets to the peer. It successfully forms a channel with a peer configured in either Active or Passive mode, making it the preferred mode for dynamic link aggregation in standards-based (IEEE 802.3ad) environments.

StackWise Virtual combines two physical switches into a single logical switch with one control plane and one management IP. Both switches actively forward traffic, and the control plane is distributed, allowing both to process control protocols. This provides active-active forwarding and simplified management, meeting the design goals.

In TACACS+, authentication and authorization are separate phases. An Access-Accept only confirms the user's identity; command authorization requires the server to explicitly send an authorization response with attributes such as 'permit' or the specific command (e.g., 'cmd=reload') to allow execution. Without any permitting AV pair, the router's authorization policy defaults to deny, so the 'reload' command is blocked despite a successful authentication.

RESTCONF on Cisco IOS XE requires authentication for all requests. HTTP 401 Unauthorized explicitly means the request lacks valid credentials. Providing a username and password via HTTP Basic Authentication (e.g., requests.get(url, auth=('admin', 'password'))) supplies the necessary authentication, allowing the request to succeed if the credentials are correct and the user has sufficient privileges.

In Cisco DNA Center, before a template can be applied to a device, the device must be provisioned to a site. Provisioning involves assigning the device to a site and configuring management IP, credentials, and other parameters. The Intent API has a provisioning endpoint that must be called after device assignment. Without provisioning, template application fails with an error indicating the device is not provisioned. This is the missing step.

The system IP and organization name are the two identifiers the SD-WAN controllers use to authenticate and track a device. Without a matching organization name and a unique system IP, the device cannot establish control connections to vBond, vSmart, and vManage, so it will not receive centralized policy or join the overlay.

SSH class (COPP_SSH) is explicitly matched with a police rate of 10000 bps, so SSH control-plane packets conform to that 10 kbps limit. The class-default is configured with a police rate of 5000 bps, applying to all other control-plane traffic not matched by a specific class. Since CoPP uses a hierarchy where class-default catches unmatched traffic, the effective result is SSH at 10 kbps and everything else at 5 kbps.

ios_config is a network module in the cisco.ios collection, and Ansible must establish a persistent network_cli connection before it can send configuration commands. Without `ansible_connection: network_cli` in inventory or `connection: network_cli` at the play level, Ansible uses the default 'smart' connection, which cannot initialize the IOS CLI terminal plugin. The playbook therefore fails with a connection error rather than reaching the module logic.

On an 802.1Q trunk, each VLAN must first exist in the switch's local VLAN database and then be explicitly included in the allowed VLAN list on the trunk interface. Without both steps, the switch filters frames for VLAN 30, even if the VLAN is defined elsewhere in the SD-Access fabric. The edge node must have a consistent local VLAN-to-SGT mapping, and traffic will be dropped in hardware if the VLAN is not present and permitted.

Passive-interface default suppresses EIGRP hello packets on every interface, preventing neighbour adjacencies from forming there. The subsequent no passive-interface GigabitEthernet0/0 re-enables hellos on that specific interface, so adjacencies form only through Gi0/0. This satisfies the stem's requirement that EIGRP updates flow solely via the designated uplink.

The correct interpretation is that CUSTOMER_A and CUSTOMER_B each use a subinterface on the same physical GigabitEthernet0/0 port: CUSTOMER_A is configured on Gi0/0.100 and CUSTOMER_B on Gi0/0.200. This is a classic VRF-lite design, where 802.1Q VLAN tags on trunk subinterfaces allow one physical link to carry traffic for multiple VRFs, with each subinterface mapped to a separate VRF. Segmenting customer traffic onto different subinterfaces of the same physical interface preserves isolation while reducing hardware port consumption.