ENCOR 350-401 (350-401) — Questions 76–150

Desirable initiates negotiation; auto waits. At least one side must be desirable to form channel.

DSCP 46 maps to EF (Expedited Forwarding), DSCP 10 maps to AF11 (Assured Forwarding class 1 low drop), DSCP 18 maps to AF21 (Assured Forwarding class 2 low drop), DSCP 26 maps to AF31 (Assured Forwarding class 3 low drop), DSCP 34 maps to AF41 (Assured Forwarding class 4 low drop).

First define the community string, then associate it with an ACL, then apply it to views or groups, and finally verify.

The correct order starts with generating gNMI protobuf stubs, then creating a gRPC channel and stub. Next, a SubscribeRequest is built with paths and mode, the Subscribe RPC is called, and finally responses are iterated from the stream.

Permit allows the packet; Deny discards the packet; Remark adds a comment; Log generates a log message for matched packets; Sequence-number assigns a line number for editing.

The output from 'show cts role-based permissions' displays a policy table where each row defines a rule for traffic from a specific Source Group (SGT) to a specific Dest Group (SGT). The third row shows Source Group 20, Dest Group 30, and Action PERMIT, meaning traffic from SGT 20 to SGT 30 is explicitly permitted. This is a Cisco TrustSec role-based access control (RBAC) policy enforced at the switch level.

Protocol 1 is ICMP, 6 is TCP, 17 is UDP, 89 is OSPF, 88 is EIGRP.

changed indicates a modification was made, ok means no change but success, failed means error, skipped means condition not met, and unreachable means host could not be contacted.

Bundled ports actively forward traffic; stand-alone ports operate individually; suspended ports are disabled due to misconfiguration.

Cisco DNA Center packages: Assurance provides analytics and troubleshooting; Provision automates device configuration; Design creates network hierarchies and settings; Policy manages access and segmentation.

MPLS offers predictable performance; broadband Internet provides low-cost but variable quality; LTE offers mobility; 5G adds low latency and high bandwidth.

eBGP peers typically use a directly connected interface or a loopback with proper routing. iBGP peers can be non-directly connected and often use loopback interfaces for stability. The TTL for eBGP is set to 1 by default, but can be increased with the ebgp-multihop command. iBGP requires that all routers in the same AS are fully meshed or use route reflectors to avoid loops. The BGP identifier (router ID) is used to identify the BGP speaker and is used in loop prevention for iBGP.

The correct order begins with the ingress PE receiving an IP packet from the CE, looking up the VRF and imposing the inner VPN label and outer MPLS label, then forwarding the MPLS packet across the core. The P router swaps the outer label, and the egress PE pops the outer label, looks up the inner VPN label, and forwards the IP packet to the destination CE.

This command injects a default route (0.0.0.0/0) into the OSPF domain unconditionally, even if the router does not have a default route in its routing table. The metric and type are set as specified.

OSPF uses different hello intervals depending on the network type. On broadcast and point-to-point networks (like Ethernet), the default hello interval is 10 seconds.

Correct: Route leaking can be done using static routes or BGP with import/export maps. Incorrect: Route leaking does not merge routing tables; VRF-lite does not inherently support it; it does not require MPLS; it is not automatic.

In OMP, the sequence starts with the edge device learning routes locally (connected, static, or dynamic), then redistributing them into OMP and sending to vSmart. vSmart processes and installs routes in its RIB, then advertises the best routes to other edge devices. The receiving edge device installs the route in its forwarding table and optionally redistributes into its local routing protocol.

WPA Personal uses Pre-Shared Key (PSK); WPA Enterprise uses 802.1X/EAP; WPA2 Personal uses PSK; WPA2 Enterprise uses 802.1X/EAP; WPA3 Personal uses Simultaneous Authentication of Equals (SAE).

The RSPAN VLAN must be created, allowed on trunks, and the remote switch must have the VLAN and monitor session configured.

SGT tags traffic, SGACL enforces policy, SXP propagates SGTs, and MACsec encrypts at Layer 2.

The vManage is the management plane for centralized configuration and monitoring. vSmart is the control plane for route and policy distribution. vBond orchestrates initial authentication and NAT traversal. vEdge routers are data plane devices that forward traffic. vSmart does not handle NAT traversal; that is vBond's role. vManage does not distribute routes; that is vSmart's role.

LSR performs label switching, LER is at the edge, P is a core transit router, PE provides service to CE, and CE is the customer edge.

Import RT determines which routes are accepted into a VRF; Export RT is attached to routes sent from a VRF; Both import and export can be configured per VRF; Import map can filter routes based on extended communities; Export map can modify RTs before advertisement.

The 'ip sla schedule' command is used to start an IP SLA operation and configure its lifetime and start time. Without this command, the IP SLA operation is configured but remains inactive. This command controls when the operation begins and how long it runs, which is essential for scheduled monitoring.

Correct: VRFs isolate customer traffic; MPLS VPN uses VRFs with route targets; VRF-aware features like NAT and QoS can be applied per VRF. Incorrect: VRFs do not replace VLANs; VRF-lite does not use labels.

The correct order starts with creating a route map with a match clause, then setting the VRF using the set vrf command, applying the route map to the incoming interface with ip policy route-map, the router matching the traffic, and finally forwarding the packet to the specified VRF.

LLQ is the correct choice because it combines strict priority queuing with CBWFQ, ensuring that voice traffic is placed into a strict priority queue that is serviced before any other queues. This guarantees low latency and prevents voice packet drops during congestion by allowing the priority queue to be policed to a configured bandwidth limit, while still providing bandwidth guarantees for the voice class.

OpenConfig is an operator-led effort. IETF publishes standard YANG models. Cisco-IOS-XE modules are Cisco proprietary.

The app-route policy must be attached to the correct site list and VPN list to be applied to the traffic. If the policy is not properly associated with the site list containing the branch office or the VPN list that includes Salesforce traffic, the vSmart will not enforce the application-aware routing rules, allowing the LTE link to be used even when the MPLS link meets the SLA.

STP is IEEE 802.1D; RSTP is IEEE 802.1w; MSTP is IEEE 802.1s; PVST+ is Cisco proprietary.

The process begins by importing the Jinja2 Environment and FileSystemLoader, creating an environment with a loader pointing to the template directory, loading the template file, defining a dictionary with variables, and finally calling render() to produce the configuration string.

PIM Hello discovers neighbors; Join requests to join a group; Prune requests to leave a group; Assert resolves duplicate forwarding on a multi-access network.

PQ gives strict priority to one queue, CBWFQ guarantees bandwidth to classes, LLQ combines strict priority with CBWFQ, WFQ provides fair queuing for flows, and CBWFQ is often used for data classes.

PAgP is a Cisco proprietary protocol for dynamic EtherChannel formation. It uses multicast address 01-00-0C-CC-CC-CC, supports modes 'auto' and 'desirable', and uses a learning method to detect misconfigurations. PAgP cannot interoperate with LACP and does not support standby links.

The output shows that for 10.1.1.0/24, the feasible distance (FD) is 1310720 and there is only one successor (the route via 192.168.1.2). The alternate path via 10.2.2.2 has a reported distance (RD) of 1310720, which equals the FD, so it does not satisfy the feasibility condition (RD < FD) and therefore is not a feasible successor. Only the successor route is installed in the routing table.

VT-x enables hardware-assisted virtualization for Intel CPUs, EPT reduces memory overhead for nested page tables, SR-IOV allows direct device assignment to VMs, AMD-V is AMD's equivalent of VT-x, and VPID improves TLB management across VM switches.

BFD session establishment starts with the vEdge sending a BFD hello packet, the remote vEdge responds with a BFD echo, then both agree on the BFD timer values, the session moves to the Up state, and finally the session is used for path liveliness detection.

The EIGRP address-family configuration for VRF RED is missing the 'no shutdown' command under the address-family mode. In Cisco IOS, EIGRP address-families are administratively shut down by default; without 'no shutdown', the EIGRP process for that VRF will not form adjacencies or advertise routes, even though the network command is correctly configured.

A centralized data policy on the vSmart must include match conditions for both the traffic (e.g., DSCP EF) and the scope of the policy (e.g., VPN list or site list). Without a site list or VPN list match, the policy may not apply to the specific branch-to-branch traffic, causing the vEdge to fall back to the default routing behavior (e.g., using the Internet link if it has lower latency). The vSmart distributes the policy to vEdges, but the vEdge only enforces it for matched traffic within the specified sites or VPNs.

L3VPN operates at Layer 3 (IP), L2VPN at Layer 2 (Ethernet/Frame Relay), VPLS is a specific L2VPN, VPWS is point-to-point L2VPN, and MVPN is multicast L3VPN.

YANG traversal starts with identifying the YANG module for interfaces, then navigating to the interfaces container, selecting the specific interface list entry, accessing the statistics container, and finally reading the desired leaf values like in-octets.

MSTP configuration begins by enabling the MSTP globally with 'spanning-tree mode mst'. Then, enter MST configuration mode, assign a region name, set the revision number, and finally map VLANs to MST instances. After exiting MST configuration mode, the region becomes active.

That the YANG path includes multiple leafs that change simultaneously, causing multiple updates for the same event. For example, when an OSPF neighbor goes from FULL to DOWN, multiple leafs (state, last-up-time, etc.) change, and each change triggers an on-change update. The other options are incorrect because the sample-interval is not used in on-change subscriptions; the collector is not causing duplicates; and the encoding does not cause duplicates.

The spine switch is a core component of a Cisco ACI fabric, forming the spine-leaf topology. Spine switches provide high-speed, non-blocking connectivity between leaf switches and handle all east-west traffic, relying on IS-IS as the routing protocol for fabric discovery and forwarding.

The show ip bgp vpnv4 vrf CUSTOMER-D output displays a BGP route for 192.168.1.0/24 with the '> ' (best) marker, and the show ip route vrf CUSTOMER-D output shows this route with a 'B' code (BGP). This confirms the route is learned via BGP and installed in the VRF routing table. The administrative distance of 200 in the routing table entry further confirms it is a BGP route (eBGP default AD is 20, but iBGP is 200; the [200/0] indicates iBGP).

Intent APIs: inventory retrieves device details; topology maps network connections; issues identifies network problems; events provides real-time notifications.

PnP steps: Claim device assigns it to a site; Provision deploys configuration; Activate applies image; Verify checks connectivity; Monitor tracks status.