ENCOR 350-401 (350-401) — Questions 1351–1425

The :rollback-on-error capability ensures that if any operation within a <commit> fails, the server automatically rolls back the entire transaction to the previous state. This provides automatic error recovery and guarantees atomicity. Without it, a partial commit could leave the device in an inconsistent state. This capability is crucial for the team's requirement to roll back on error.

PIM sparse-mode is explicitly enabled on the interface with the ip pim sparse-mode command, which also activates IGMPv3 as the host membership protocol. In sparse mode, routers must send explicit join messages toward a rendezvous point (RP) to build multicast distribution trees. Without a configured or dynamically learned RP (e.g., via Auto-RP or BSR), the router cannot construct these shared trees, and multicast forwarding will fail. Therefore, the interface does participate in both PIM sparse-mode and IGMPv3, but the missing RP is a critical operational requirement.

The packet enters via Gi0/1/0, and the exhibit shows this interface is configured in VRF CUSTOMER-A. When a packet arrives on an interface, the router immediately associates it with that interface's VRF and performs the destination IP lookup in the corresponding VRF-specific routing table. Because Gi0/1/0 belongs to CUSTOMER-A, the forwarding decision uses the routes, next hops, and constructs (e.g., VRF-specific ARP or CEF) belonging to CUSTOMER-A. This is why CUSTOMER-A is the correct answer.

The HTTP operation type in IP SLA sends HTTP requests to a specified URL and measures the response time. It can be configured to use GET or RAW operations and can measure the time to establish a TCP connection, send the request, and receive the response. This directly measures HTTP traffic RTT, which is what the engineer wants. It is the correct choice for measuring HTTP performance.

Configuring 'port-channel min-links 2' on the port-channel interface instructs the switch to bring the bundle into operation only when at least two member links are physically up and have completed negotiation. If the number of active links falls below this threshold, the port-channel is administratively shut down to prevent application traffic from relying on a single link with degraded bandwidth. This command is supported for both LACP and PAgP and is the correct method to enforce a minimum link count.

Each PE router holds a separate VRF table per VPN customer, isolating that customer's routes and forwarding decisions. This satisfies the stem's Layer 3 VPN requirement by preventing overlapping customer address space from colliding, keeping each VPN's traffic logically separate across the shared provider backbone.

The parentName parameter places the new building within the existing site hierarchy by naming its immediate parent, here Area-1. Cisco DNA Center requires this to attach Building-B beneath the correct area rather than at the global root.

The DNA Center REST API is protected by token-based authentication. A playbook must first send a POST request to /dna/system/api/v1/auth/token using Basic Auth with valid credentials; the JSON response contains a Token field that must be passed in the X-Auth-Token header for all subsequent API calls. Without this initial task, the GET request in the playbook will be rejected with HTTP 401 Unauthorized, regardless of other settings.

For a YANG model to be accessible via NETCONF, it must be advertised in the device's NETCONF capabilities. Even if the model file exists, if it is not enabled or supported by the NETCONF server, requests will fail. The engineer should check the <hello> message for the model's namespace and revision. This is the most likely cause of the error.

A basic LDP session requires a hello adjacency, which is built only after receiving a valid hello from the peer. The output shows 'no hello (expired)', meaning the LDP hello holdtimer elapsed without any hello from 10.5.5.4. Therefore, the TCP connection and LDP session with that neighbor are not established, even though the local interface is in xmit/recv mode.

The show vxlan vni command displays the mapping between VLANs and VNIs and indicates whether the VXLAN interface is up. If the VLAN-to-VNI mapping is missing or the VXLAN interface is down, hosts cannot be placed into the correct overlay, which matches the symptom of remote reachability failing despite EVPN routes being present.

This is correct. Applying 'no switchport' to the physical interfaces makes them routed Layer 3 ports, and 'channel-group X mode on' bundles them unconditionally into a port-channel. Because the member interfaces are all routed, the resulting port-channel also operates as a Layer 3 interface, allowing IP addresses to be assigned directly to the port-channel for routing.

Syslog sends event-driven data from devices to a collector, fitting the telemetry definition.

Entry 30 of the ACL is an explicit deny statement for SSH traffic from any source IP address that has not already been permitted by entries 10 or 20. Because the source prefix 192.168.1.0/24 is outside the ranges specified in those earlier permit statements, it matches the wildcard condition of entry 30 and is denied. This occurs before the final permit-any statement (entry 40), which only applies to non-SSH traffic. Thus, SSH access from 192.168.1.0/24 is indeed denied.

Applying a distribute list under the BGP neighbor configuration for ISP-A creates an inbound path-filtering mechanism that evaluates each incoming BGP update against a referenced prefix list or access list. The distribute list examines only the NLRI's prefix and prefix length, permitting exactly the specified prefixes and silently ignoring all others before any other BGP policy is applied. This is the simplest and most targeted method for the stated requirement, as it does not involve attribute modification or complex conditional logic.

Network modules require the playbook to set 'connection: network_cli' and 'become: yes' so Ansible can interact with the device's CLI over SSH with privilege escalation. Without 'network_cli', the default 'smart' connection attempts to use the general SSH connection, which does not handle device prompts, terminal length, or enable mode correctly. 'become: yes' is needed to enter privileged exec mode on most Cisco IOS/CSR devices, especially for commands like 'show serial number' or 'show version' that require enable privileges.

The 'Over thresholds' counter in IP SLA statistics tracks how many successful probes had an RTT greater than the configured threshold. This counter is 8, meaning eight probes completed, but their round-trip time exceeded the threshold. These probes are not failures—they got a response—but they violate the SLA latency objective. Thus this option correctly interprets the number 8.

The feasibility condition requires a neighbour's reported distance to be strictly lower than the local feasible distance. Meeting this guarantees the path is loop-free, which is exactly what qualifies that neighbour as a feasible successor and satisfies the stem's stated criterion.

StackWise Virtual merges two Catalyst 9000 chassis into one logical switch with a unified control plane, one management address, and one configuration. Multichassis EtherChannel, an MEC, lets a downstream access switch bundle uplinks to both chassis into one port-channel, so all links forward and spanning tree sees a single logical neighbor. This satisfies both the bandwidth and the single-logical-device requirements in the distribution pair.

The crypto ACL defines interesting traffic by permitting the specific source and destination subnets. Only traffic matching a permit statement is encrypted. An implicit deny at the end means other traffic is not matched and therefore not encrypted, which aligns with the requirement to send other traffic unencrypted. This is the correct way to define the VPN traffic selector.

This route-map, applied outbound to neighbor 10.1.1.2, sets the Multi-Exit Discriminator (MED) to 50 for all prefixes sent to that peer. Because MED is an inbound path-selection metric, AS 65001 will prefer the lowest MED among paths to AS 65000, so this value of 50 makes this path less attractive than a lower-MED path, steering traffic away from this link when an alternative exists.

During 802.1X authentication, the endpoint credentials are sent to ISE (the policy server). Upon validation, ISE returns a RADIUS Access-Accept message that carries the Security Group Tag (SGT) as a Cisco AV-pair (e.g., cisco-av-pair=...). The switch then programs this SGT for the session and uses it to enforce TrustSec policies, such as SGACLs. This ensures the classification is centralized, consistent, and dynamic based on the user or device identity.

A VRF maintains its own separate routing and forwarding table, so prefixes in the global table are not automatically visible inside CUSTOMER_A. Because the destination prefix exists only in the global table, the VRF has no matching route and drops the traffic. The engineer must either leak the global prefix into the VRF or provide a default route within the VRF.

An HTTP 400 Bad Request in vManage often indicates that the request body fails validation against the expected schema. Even if JSON syntax is correct, semantic errors like invalid IP addresses, missing required fields, or incorrect data types cause the API to reject the payload. Correcting the field values to match the template schema resolves the issue.

In a WLC-centric deployment, all access points must run a software release that is supported by and interoperable with the controller's firmware. Here, every AP displays the identical version 8.5.151.0, which indicates a uniform, compatible codebase. This consistency, combined with the WLC successfully listing them without join errors, confirms that all APs are running the same software and are fully compatible with the WLC.

If the timeout value is set lower than the actual round-trip time, the probe will time out even if the response eventually arrives. This is common in high-latency networks. Adjusting the timeout to accommodate network conditions can resolve the timeouts.

The State/PfxRcd column of show ip bgp summary lists how many BGP prefixes have been accepted from each specific neighbor. Router R3's output shows 150 prefixes from one neighbor and 200 from the other, and adding these two independent count values yields 350 total received prefixes. This total represents all successful UPDATE messages that R3 has processed from its two peers, not a mere administrative distance or route metric.

The vManage REST API requires authentication using a session token. The client must first POST credentials to /j_security_check to obtain a JSESSIONID cookie, which is then included in subsequent requests. Without this token, the server returns 401 Unauthorized. The script must authenticate before accessing /dataservice/device. This is the most likely cause of the error.

The network_cli connection plugin is designed for network devices and supports SSH key-based authentication. By copying the public key to the switches, Ansible can authenticate using the private key without passwords. This meets the requirement of no password prompts and no plaintext passwords. The network_cli plugin handles the SSH session and CLI interaction.

Using a YANG model validator ensures the configuration adheres to the device's data model, catching syntax and semantic errors early. This validation can be automated in the CI pipeline, preventing invalid configurations from being deployed. It aligns with infrastructure-as-code best practices.

The module's parents parameter is designed to provide the configuration context under which the lines should be applied. When you set parents to 'vlan 100' and simultaneously include 'vlan 100' in the lines list, the module builds a configuration hierarchy where 'vlan 100' appears as a subcommand of itself. NX-OS rejects this invalid nested structure because a command cannot serve as its own parent. Therefore, the module raises an error and the intended VLAN configuration is never applied.

This configuration is correct because the command 'ip pim rp-address 172.16.1.1' statically designates 172.16.1.1 as the rendezvous point for all multicast groups, and the accompanying 'ip pim sparse-mode' statements on both interfaces ensure PIM operates in sparse mode, which is required for RP-based multicast forwarding. Static RP assignment takes precedence over dynamic mechanisms like Auto-RP or BSR, and it applies globally to all groups unless a group-list qualifier is specified. With sparse-mode enabled, receivers explicitly join via the RP, and senders register with the RP, establishing the shared tree before potentially switching to the shortest path tree.

DHCP snooping drops DHCP server messages (OFFER, ACK) received on untrusted ports. By default, all ports are untrusted. The port connected to the DHCP server must be explicitly configured with 'ip dhcp snooping trust' to allow server responses. Since the server is on GigabitEthernet1/0/5 and is not trusted, its offers are dropped, matching the symptom.

Agentless tools interact with devices using existing interfaces like RESTCONF, NETCONF, or SSH CLI. They may parse CLI output or use structured APIs to apply changes. This approach avoids installing software on devices. This statement is correct and highlights how agentless tools operate.

This command instructs the switch to place the port into the specified guest VLAN when the RADIUS server fails to respond to authentication requests, satisfying the requirement to avoid shutting the port down. It is part of Cisco IOS 802.1X authentication event configuration and directly addresses the server-dead condition by authorizing a fallback VLAN rather than a critical VLAN.

The flow monitor in this configuration references the record type 'netflow ipv4 original-input' and is linked to a flow exporter that sends packets to 192.168.1.100 via UDP port 2055. Because the exporter does not explicitly set a version, Cisco IOS/IOS-XE defaults to NetFlow v9, which is the template-based format required for the flexible fields in this record. Therefore, the exported traffic is indeed NetFlow v9 records to that collector/port.

In Cisco SD-WAN, a control policy configured on a vSmart controller matches OMP routes based on attributes such as prefix and applies actions before the routes are advertised via OMP. This policy uses a prefix-list to match 10.0.0.0/24 and sets the OMP community value 100:10 on those matched routes, which then propagate through the overlay to remote edges. The local RIB and routing table are not modified; only the OMP route attributes are updated for advertisement.

NSO provides a reconcile action that compares the actual device configuration with the intended configuration from the service model and re-applies any missing or altered settings. This action can be triggered manually or scheduled. By enabling reconcile, the engineer ensures that drift is corrected according to the service model. This is the correct feature for enforcing configuration compliance in NSO.

Each VRF instance is a separate Layer 3 routing domain, so it holds its own RIB, Cisco Express Forwarding adjacency table and forwarding information base. This isolation satisfies the stem's requirement that VRFs keep traffic and routes distinct on shared hardware.

The 'vrf definition CUSTOMER' command in global configuration mode creates a VRF instance named CUSTOMER. This command is used in Cisco IOS-XE to define a VRF and enter VRF configuration mode, where you can specify address families, route targets, and other parameters. It is the correct way to create a VRF for MPLS VPN or other segmentation purposes.

IGMP snooping lets a Layer 2 switch inspect IGMP join and leave messages, building a per-VLAN multicast forwarding table. Frames are then forwarded only to ports with interested receivers, satisfying the stem's requirement to reduce unnecessary multicast flooding.

Correct: When the native VLAN is configured as 999 on the EtherChannel, the port-channel treats all untagged frames as belonging to VLAN 999. This is standard 802.1Q trunk behavior: untagged frames are placed into the native VLAN, and in this case the native VLAN is explicitly set to 999 rather than the default VLAN 1. Both ends of the EtherChannel must agree on the native VLAN value to avoid misconfiguration, and here that consistency is maintained.

LLQ combines strict priority queuing with CBWFQ. It designates one or more classes as priority queues, which are serviced before any other queues. This ensures that voice traffic receives strict priority treatment and minimal delay and jitter, even during congestion. LLQ also includes a policer to limit the priority queue bandwidth, preventing starvation of other traffic. It directly satisfies the requirement for strict priority for voice.

The 'save_when' parameter in the ios_config module controls when the running configuration is saved to the startup configuration. Setting it to 'always' ensures that after any configuration change, the running config is saved. This directly addresses the issue of changes not persisting after reboot. It is the correct parameter to use.

Setting the 'keepalive' parameter in the Paramiko Transport object is the correct approach because it tells the SSH transport layer to send keepalive packets on its own at the specified interval, without interfering with any running shell commands. Paramiko's `set_keepalive()` method works by transmitting a simple SSH protocol message (e.g., an SSH2_MSG_IGNORE or global request) whenever no data has been sent for that interval. These lightweight packets reset the idle timers on firewalls and the remote SSH server, keeping the session open cleanly and automatically.

SD-Access uses VXLAN encapsulation in the fabric data plane. Each virtual network is mapped to a unique VNI, and the fabric edge nodes and border nodes act as VTEPs. The endpoint traffic is carried inside VXLAN tunnels across the underlay, which allows Layer 2 and Layer 3 communication between endpoints attached to different edge nodes while maintaining segmentation.

PBR matches traffic based on source, destination, or protocol and overrides the routing table by setting a next-hop to the VNF, all without changing endpoint IP configuration. This enables selective, policy-based service chaining while keeping the original source and destination addresses intact, so the VNF can process traffic and forward it back to the intended path.

Client 360 provides a detailed view of a specific client's connectivity, including onboarding, authentication, association, and performance metrics. It shows the client's health score, issues, and the ability to drill down into specific events and path trace. This is the correct tool to determine why a client has a poor health score, as it aggregates data from multiple sources and provides root cause analysis.

MDA allows both a data device and a voice device to authenticate independently on the same switch port. It places the phone in the voice VLAN and the PC in the data VLAN, each with its own authentication session. This matches the requirement to authenticate the phone via MAB and the PC via 802.1X. MDA is designed for this exact scenario.

The router is correctly identified as having mixed PIM modes on different interfaces because the neighbor table shows one neighbor in Dense mode and another in Sparse mode. This indicates that the router's interfaces are configured with different PIM modes, as PIM mode is a per-interface setting. Such a configuration is valid but can lead to suboptimal multicast behavior if not carefully planned, as dense mode floods traffic while sparse mode requires explicit joins.

An MTU mismatch is the classic cause of an OSPF neighbor being stuck in EXSTART; during the Database Description exchange, each router advertises its outgoing interface MTU in the DBD packet header. If one router's interface has a lower MTU, it discards DBD packets that declare a larger MTU, so the neighboring router never receives a valid acknowledgment and remains in EXSTART. Because OSPF does not initialize the DBD exchange until both MTUs are verified equal, the adjacency stalls at the point where the Master/Slave election occurs, exactly matching the reported symptom.

Auto QoS for VoIP on access ports dynamically configures the necessary trust boundaries, classification, and egress queuing to properly handle voice traffic. It typically sets the ingress port to trust CoS for the connected IP phone, marks voice traffic appropriately, and places it in the priority queue to minimize latency and drop risk. This is the correct remediation because it matches the network behavior to the requirements of voice—ensuring priority without manual, error-prone configuration.

The `rx` keyword restricts the source to ingress traffic only, so frames received on GigabitEthernet1/0/3 are copied to the destination port GigabitEthernet1/0/4. Egress traffic transmitted out of the source interface is not mirrored, satisfying the stem's receive-only monitoring constraint.

Cisco SD-Access uses VXLAN as the data plane encapsulation, and it adds a Group Policy Option header to carry security group tag information. This allows the fabric to enforce group-based policies without requiring traditional ACLs on every device, which is a core part of the SD-Access architecture.

LLQ combines a strict priority queue with CBWFQ, ensuring that voice packets are always transmitted first, which minimizes both latency and jitter for real-time traffic. The priority queue is typically policed to a configured bandwidth limit to prevent a flood of voice traffic from starving video or data. Meanwhile, video and data are placed into CBWFQ classes that receive guaranteed bandwidth under the weighted fair scheduler, allowing the design to satisfy both strict voice latency and bandwidth guarantees for other critical applications.

This is the correct answer. The 'bandwidth' command, in a CBWFQ policy map, explicitly allocates a guaranteed rate from the total interface bandwidth, and that rate is reserved under congestion. In contrast, 'bandwidth remaining' specifies a percentage or proportion of the bandwidth that is left after the priority queue (for low-latency traffic) and after all explicit 'bandwidth' allocations have been satisfied. Therefore, 'bandwidth remaining' is a fair-sharing mechanism for the leftover, non-priority bandwidth rather than a reservation from the full link capacity.

RA guard is a policy-based IPv6 first-hop security feature that forwards Router Advertisements only from devices explicitly authorized by the policy. If the legitimate default gateway's IPv6 address or MAC address is not listed in that policy, the switch treats those RAs as rogue and silently drops them. Consequently, hosts never receive the gateway's prefix information or default route, breaking SLAAC and causing the reported connectivity loss. The fix is to add the actual gateway to the RA guard policy as a trusted device.

Cisco SD-WAN centralized data policy lets the engineer define traffic steering rules based on application, source, destination, and other match criteria, and then apply actions such as directing traffic over a specific VPN or out the local internet connection. Application-aware routing continuously measures path characteristics to select the best path. Together they satisfy the requirement to send SaaS traffic directly to the internet while forcing critical traffic through IPsec tunnels to the data centers.

The configuration 'shape (average) cir 1000000' indicates a committed information rate (CIR) of 1,000,000 bits per second, which equals 1 Mbps. Shaping averages the traffic rate over time by buffering bursts and draining them through a token bucket, so the long-term average matches the CIR. This is the correct interpretation of the policy's behavior.

EVPN is a BGP address family (L2VPN EVPN) that carries MAC and IP reachability information. VTEPs peer with each other or with route reflectors using MP-BGP and advertise EVPN routes. This replaces flood-and-learn for MAC learning and provides control-plane learning, making the statement correct for an EVPN deployment.

This command enables the voice VLAN on the interface, allowing the switch to send Cisco Discovery Protocol (CDP) or Link Layer Discovery Protocol (LLDP) information to the IP phone. The phone can then tag voice traffic with the appropriate VLAN and CoS. It also allows data traffic from the PC to be untagged. This is the correct configuration for a voice VLAN.

FlexVPN is a Cisco IOS framework that uses IKEv2 and supports IPv6 transport. It allows per-user policy enforcement through authorization attributes such as IP address, DNS, and split tunnel ACLs. It is well suited for remote access VPN headends and can scale to many users while maintaining granular policy control.

VRF provides separate routing and forwarding tables on a single device, and combining it with 802.1Q subinterfaces allows traffic from multiple tenants to be tagged and mapped to distinct VRFs on the same physical link. This satisfies the isolation and shared-link requirements exactly as described.