ENCOR 350-401 (350-401) — Questions 76–150

The IP SLA statistics reveal 100 successful probes with zero failures, meaning every request received a timely response and the operation has operated flawlessly over its lifetime. Additionally, the return code is 'OK', confirming the latest probe is also successful, and the over-threshold counter is 0, so no latency issues have been encountered. This all indicates the operation is functioning correctly and meeting its configured performance expectations.

Option 3 is correct. The `show spanning-tree` output for this VLAN/instance lists Gi0/1, Gi0/2, and Gi0/3 in the Forwarding (FWD) state, meaning these three ports are actively forwarding Ethernet frames. Gi0/4 is shown in the Blocking (BLK) state, so it is not forwarding user traffic. Therefore, exactly three ports are in the forwarding state, making answer 3 the correct choice.

PortFast is configured on this access port, so the switch immediately moves the interface to the STP forwarding state, bypassing the 15-second listening and 15-second learning states. It still runs Spanning Tree Protocol and can send BPDUs, but it does not wait for the normal 30-second convergence delay before forwarding user traffic. This is intended for end hosts that should not cause a layer-2 loop.

SNMPv3 is the correct answer because its User-based Security Model (USM) uses a username and engineID to create localized authentication keys. USM supports authentication via HMAC-MD5 or HMAC-SHA and can encrypt traffic with AES or DES, providing noAuthNoPriv, authNoPriv, and authPriv security levels. This is the first SNMP standard to support real user-based authentication and view-based access control.

In Ansible's Cisco IOS configuration modules (such as ios_config), the 'backup_options' parameter accepts a dictionary with a 'dir_path' key. This key determines the local filesystem directory where the configuration backup file is written when backup functionality is enabled. The filename itself is automatically generated with a timestamp, so dir_path only controls the location, not the name.

Multi-Exit Discriminator (MED) is an attribute carried across an AS and is compared only for routes from the same neighboring AS; the lowest MED is preferred. A higher MED value makes a route less desirable and would cause BGP to select the competing path with the lower MED as best. Therefore, this route being non-best is consistent with having a higher MED than the best path.

The command 'ipv6 ospf 1 area 0' is used in interface configuration mode to enable OSPFv3 on that interface and assign it to area 0. The process ID '1' must match the OSPFv3 process configured globally with 'ipv6 router ospf 1'. This command allows the interface to form adjacencies and participate in OSPFv3. Without it, OSPFv3 will not run on the interface, even if the global process is configured.

The playbook is likely omitting OSPF attributes that the nxos_ospf module tracks, such as 'router-id'. When a parameter is not specified, the module may treat the desired value as empty or default (e.g., the router-id derived from the loopback address), while the running configuration contains an explicit value, causing the module to detect a difference and report 'changed'. This is a classic idempotency issue: the module does not ignore unspecified parameters; it attempts to reconcile the configuration to the playbook's declared state, and every run sees the same mismatch.

Cisco ISE is the policy server that assigns SGTs to users and devices during authentication. It also defines security group access control policies (SGACLs) that determine which tags can communicate. Without ISE, there is no centralized source for tag assignment and policy, so it is a fundamental component of a TrustSec deployment.

Configuring the core switches with routed ports (no switchport) enables pure Layer 3 forwarding, eliminating MAC address table entries for those interfaces and relying on routing protocols or static routes. This directly satisfies the requirement to avoid a large MAC address table and forward based on Layer 3 reachability, which is typical in a three-tier campus core.

OSPF computes external routes from type 5 LSAs only if the originating ASBR is reachable through an intra-area or inter-area route. The SPF algorithm builds a shortest-path tree to the ASBR first; if the ASBR's router LSA is missing or the resulting next hop has no valid OSPF route, the external prefix is left in the LSDB but never installed in the RIB. This is a fundamental adjacency-dependent rule for external route installation.

MPLS TE Fast Reroute is the mechanism that provisions pre-established bypass tunnels to protect specific links or nodes along the primary TE path. Without FRR, a link failure forces the headend LSR to detect the outage, recompute a new path using CSPF, and re-signal the tunnel, resulting in a multi-second outage. Enabling FRR with the 'fast-reroute' or 'link protection' keyword under the tunnel interface is what actually installs precomputed backup paths for immediate local protection.

Extended ACLs match on Layer 3 and Layer 4 fields, including both source and destination addresses, unlike standard ACLs which filter on source only. This satisfies the stem's requirement by confirming the broader matching capability that distinguishes extended from standard ACLs on Cisco IOS.

TrustSec SGACLs are enforced against security group tags rather than IP addresses, so each rule matches a source SGT and destination SGT pair. This satisfies the stem's requirement for a true statement about SGACL policy definition.

In NetFlow v9 and IPFIX, option data records are carried in dedicated option template flow sets that the exporter transmits on a periodic interval. These records supply metadata such as interface names, interface descriptions, and application IDs, which the collector uses to enrich the flow records it has already received. Because option data is refresh-based, the exporter re-sends it so the collector always has current context.

Fabric border nodes provide the handoff between the fabric and external networks such as data center, WAN, or legacy campus. They run routing adjacencies and redistribute or leak routes between the fabric's VXLAN domain and outside domains, which is exactly what the scenario describes.

This configuration allows the switch port to carry data traffic for the PC in the access VLAN (untagged) and voice traffic for the phone in the voice VLAN (tagged with 802.1Q). The 'switchport voice vlan' command instructs the switch to use CDP to tell the phone which VLAN to use for voice. This is the standard and recommended method for connecting Cisco IP phones and PCs on the same port.

The ingress network device is responsible for classifying traffic and imposing the SGT. It receives the SGT value from ISE during authentication, then inserts the tag into the packet using inline tagging (Cisco Metadata or 802.1AE) or propagates the mapping via SXP to devices that do not support inline tagging. This is the enforcement point for tag imposition.

Creating an 802.1Q trunk with subinterfaces lets each switch or router terminate multiple VLANs on a single physical link, and each subinterface can be explicitly bound to a tenant's VRF. This gives each tenant an isolated routing table; the switch will route packets received on a subinterface using only the routes in that subinterface's assigned VRF. The trunk carries tagged frames for all tenants, but the VRF association ensures that traffic from tenant A's VLAN never enters tenant B's routing path, even though they share the same physical ports and trunk. This is a standard VRF-lite design for inter-switch VRF connectivity.

VXLAN encapsulates Layer 2 frames in UDP, and the IANA-assigned default destination port is 4789. Cisco platforms use this port by default when sending VXLAN-encapsulated traffic. If a firewall or ACL is in the path, it must permit UDP 4789 so that the tunnel traffic is not dropped. Changing the port is possible but uncommon and must match on all VTEPs.

CoPP class maps identify control-plane traffic by matching ACLs or protocols, separating it into classes. The policy map then applies actions per class, satisfying the requirement to classify traffic destined for the control plane before rate-limiting it.

PAgP desirable mode actively transmits PAgP packets on the physical ports, initiating the negotiation to form an EtherChannel with the neighboring switch. This is the required behavior when the peer is configured with a PAgP mode such as desirable or auto, because desirable ensures that at least one side is driving the negotiation. It also validates that the ports on both ends meet consistency requirements before the channel is established.

SXP (SGT Exchange Protocol) is used to propagate SGT information between Cisco TrustSec-capable devices, especially when some devices do not support hardware-based SGT tagging. It allows IP-to-SGT mappings to be shared across network boundaries, enabling consistent policy enforcement. In this scenario, SXP is the correct protocol to carry SGT information between devices that need to enforce role-based segmentation.

A trunk port tags frames with 802.1Q VLAN identifiers, allowing multiple VLANs to traverse one physical link to the router. Access ports carry only a single untagged VLAN, so they cannot satisfy the multi-VLAN requirement.

The presence of an IP address on the dialer interface is fundamental to PPPoE operation. During PPPoE, the ISP assigns an IPv4 address through IPCP (IP Control Protocol) as part of the PPP negotiation. If the dialer interface lacks an IP address, the router cannot build a usable routing table entry for the default route, and all traffic destined for the Internet is dropped because there is no valid source address. Without this IPCP-assigned address, even though the PPPoE session is established at Layer 2, the router has no IP reachability to the ISP gateway.

MDA allows both a voice device (phone) and a data device (PC) to authenticate independently on the same switch port. Each device is authenticated in its respective VLAN (voice and data), and the switch applies separate policies. This meets the requirement of authenticating both devices separately.

The route-map is applied in the outbound direction to neighbor 10.0.0.2. The single permit sequence without a match clause matches all routes, and the set metric 50 command sets the MED to 50. Therefore, every route advertised to that neighbor will carry the MED value of 50. No filtering occurs; the route-map simply modifies the MED attribute for all outbound updates.

Cisco DNA Center Assurance allows administrators to define issues and configure notifications based on health score thresholds. By setting up assurance issues, the system can trigger alerts via email, syslog, or webhook when a switch's health score falls below a specified value. This is the correct feature for proactive alerting.

The router uses the longest prefix match rule. The specific route 10.1.1.0/24 has a prefix length of 24, while the default route has a prefix length of 0. The more specific route wins, so the packet is forwarded using the static route for 10.1.1.0/24 via 192.168.1.1.

The fabric edge switch is the correct enforcement point for SGT policies in an SD-Access fabric. When a wired or wireless endpoint authenticates via ISE, the edge switch receives the SGT through RADIUS (or CoA) and associates it with the endpoint's MAC/IP address. Every packet from that endpoint is then classified with the SGT, and the edge switch applies the corresponding SGACL in hardware to permit or deny traffic based on source and destination SGTs. This occurs at the access layer, exactly where the endpoint connects, making the fabric edge the critical device for enforcing SGT-based policies.

The DHCPACK message carries the allocated IPv4 address in the 'yiaddr' field; here that value is 10.0.0.2. After receiving a DHCPREQUEST, the server verifies the binding and responds with DHCPACK to conclude the lease creation process. This proves the server successfully assigned that specific address to the client, and the client is now permitted to configure 10.0.0.2 on its interface.

A 403 Forbidden error indicates that the server understood the request but refuses to authorize it. Even with a valid session, the user's role must include permission to access the /dataservice/device endpoint. The engineer should check the user's role and group permissions in vManage to ensure they have read access to device inventory.

The Method field for session 5 reads 'local', which confirms the user was authenticated using the device's local user database, typically configured with 'username' global commands or in the local AAA configuration. Local authentication is commonly used as a fallback method or for console access, and it does not involve any external AAA server. The device compared the supplied credentials directly against its stored username and password hashes, and on success, established the session.

UDP jitter probes send timestamped packets at scheduled intervals, letting the responder compute per-direction delay, jitter and loss, satisfying the stem's requirement for bidirectional measurement. Unlike ICMP echo, which reports only round-trip statistics, this operation distinguishes each direction's performance.

Application-aware routing policies in Cisco SD-WAN use SLA classes to monitor path characteristics such as latency, jitter, and loss. By associating business-critical traffic with an SLA class that prefers MPLS and configuring a fallback to broadband, the engineer ensures preferred path selection and automatic failover when the MPLS circuit degrades.

Max age is the STP timer that dictates how long a switch will store BPDU information before considering it stale. By default, this is 20 seconds; if no new BPDU arrives from a neighbor within that window, the switch discards the outdated information and may trigger a topology recalculation. This ensures that no switch acts on obsolete root or path information, which could result in loops or suboptimal forwarding paths.

Wrapping the connection and backup logic inside a try-except block within the for loop directly addresses the failure point: each device's operations are executed in its own protected scope. When a device raises an exception (e.g., NetMikoTimeoutException or NetMikoAuthenticationException), the except clause catches it, allowing the script to log the error and continue with the next iteration. This pattern, often called 'fail-continue', ensures that a single unreachable or misconfigured device does not abort the backup process for all remaining devices, which is the core requirement of a resilient network automation script.

NFV's core architectural principle separates network functions such as firewalls and routers from dedicated, vendor-specific appliances, letting them run as software on general-purpose servers. This decoupling directly satisfies the stem's requirement for a true statement about NFV architecture.

Local preference is the second attribute in Cisco's BGP best-path selection process, immediately after the locally significant weight. Because it is a well-known discretionary attribute, it is advertised among iBGP peers within an AS, allowing a network operator to influence outbound traffic across all routers. A higher local preference means the path is more preferred, so it overrides even a longer AS path.

The 'encapsulation replicate' keyword tells the SPAN destination port to preserve the original 802.1Q VLAN tag on every mirrored frame sent to the monitoring device. Without this keyword, the switch strips the VLAN tag and delivers untagged frames, which can obscure which VLAN a packet originally traversed. Using this feature ensures the monitor can see VLAN membership, which is critical for troubleshooting per-VLAN issues.

The ios_facts module is specifically designed to collect facts from Cisco IOS devices, including IOS XE. It gathers information such as hostname, version, interfaces, and hardware details. Using this module, the administrator can retrieve operational data and display it using the debug or other output mechanisms. It is the correct choice for fact gathering on Cisco IOS XE platforms.

A GET request with an Accept header of application/yang-data+json asks the server to return the YANG configuration data for GigabitEthernet1/0/1 serialized as JSON, per RFC 7951. The server resolves the URI to a specific data node in the running datastore and sends a 200 OK response whose body represents that interface's configuration. This is a read-only operation; the configuration itself remains unchanged. Thus, the correct outcome is a JSON-formatted retrieval of the interface configuration.

Functions encapsulate reusable logic, so repeated configuration or parsing tasks are defined once and called many times, directly satisfying the maintainability constraint in the stem. This reduces duplication across scripts, lowering the risk of inconsistent edits when changes are required.

DHCP option 66 is used to specify the TFTP server name or IP address. In Cisco IOS, this is configured with the 'option 66 ip <ip-address>' command within the DHCP pool. This option is commonly used for IP phones and other devices that need to download configuration files from a TFTP server. Therefore, it is the correct choice to provide the TFTP server address.

MACsec uses the MACsec Key Agreement (MKA) protocol, which relies on a Connectivity Association Key (CAK) and its name (CKN). When configured with a static pre-shared CAK/CKN, MKA derives the Secure Association Key (SAK) used to encrypt traffic. This is the standard, low-configuration deployment for a point-to-point uplink and meets the requirement for standards-based key agreement.

This configuration sets the port as an access port for data VLAN 100 and enables voice VLAN 200 for tagged voice traffic from the IP phone. The phone will tag voice frames with VLAN 200, while the PC sends untagged frames that are placed in VLAN 100. This is the standard Cisco IP phone configuration.

The absence of the 'candidate' capability in the NETCONF capabilities list means the device does not support the candidate datastore. NETCONF operations like edit-config with candidate target or commit will fail. The engineer must use the running datastore directly or enable candidate support if available.

This is correct because vBond is the first point of contact for WAN Edge devices; it validates their identity and provides the information needed to reach vManage and vSmart. It acts as the orchestrator for control connections, enabling secure onboarding without pre-configuring every peer address on each edge device.

OSPF DR/BDR election is based first on interface priority, then on Router ID. The highest priority wins. Priority 255 is the maximum value and ensures Router A has the highest priority on the segment, making it the DR provided no other router has the same priority with a higher Router ID. This is the standard way to force a router to become DR.

Creating a dedicated guest WLAN mapped to a separate VLAN, combined with ACLs or firewall rules between the guest and corporate subnets, provides clear Layer 2 and Layer 3 separation. This approach isolates guest traffic while allowing shared physical access points. It directly satisfies the requirement to separate guest and corporate clients, making it the correct design choice.

eBGP peers conventionally establish sessions across directly connected interfaces, since TTL defaults to one. The ebgp-multihop command raises that TTL, permitting sessions between non-adjacent routers separated by intermediate hops. This satisfies the stem's requirement that eBGP peering is typically direct but can be extended across multiple hops when needed.

vManage is the centralized management plane in Cisco SD-WAN. It hosts the templates and orchestrates configuration pushes to WAN edge devices via the vBond and vSmart controllers. When a template is attached to a device, vManage generates the configuration and sends it to the device. This makes vManage the correct component for automating branch deployment.

This is correct because Flexible NetFlow permits a flow record that matches only the target application via NBAR (e.g., using an application match in a flow record) or an ACL in a flow monitor. Adding a sampler rate—for instance, sampling 1 out of every N packets—reduces the number of packets that must be inspected and cached, lowering CPU utilization and export bandwidth while still providing statistically accurate application-level visibility. This confines resource consumption to the specific traffic of interest rather than processing every flow on the switch.

VXLAN with EVPN is the correct solution because it combines a Layer 2 data-plane overlay (VXLAN over UDP) with a modern BGP-based control plane (EVPN) that advertises MAC and IP reachability per VNI. This enables stretched Layer 2 forwarding across an IP underlay, allowing VMs to retain their IP and MAC addresses while migrating between switches, with EVPN providing MAC learning, ARP suppression, and multi-homing capabilities. It is purpose-built for constructing flexible, scalable network fabrics for internal mobility and is the standard approach for legacy-to-fabric migration scenarios.

If the Catalyst Center appliance's IP address is changed after an upgrade, the management network's routing and ARP entries are disrupted. Devices that are configured to send telemetry or accept management commands to/from the old IP address will no longer be reachable, because their ARP caches, DHCP reservations, or static routes still reference the previous address. Additionally, any access control lists on the devices that permit management traffic from the appliance's old IP will silently drop the new source address. This directly explains why all devices become unreachable after the upgrade, even though the appliance itself is up.

The always keyword removes the dependency on a local default route, so the router advertises 0.0.0.0/0 into OSPF regardless of its own routing table. The metric 10 and metric-type 1 arguments set the advertised cost and mark it as an E1 external route.

This is the correct root cause. The WLC is configured to tag wireless client traffic on VLAN 100 and sends it over the uplink to the switch. The switch trunk port carrying this uplink must have VLAN 100 explicitly allowed in its allowed VLAN list; otherwise, the switch drops the tagged frames, preventing client traffic from reaching the rest of the network. Since the clients get IP addresses from a DHCP server reachable through the trunk (or at least associate successfully), the failure is at the trunk's egress filtering, not at the authentication phase.

vBond orchestrator is the correct answer because it provides the initial orchestration, authentication, and NAT traversal that allow vEdge and vSmart routers to discover and securely connect to vManage. It acts as the security trust anchor in Cisco SD-WAN, distributing certificates and ensuring all devices are authenticated before they join the overlay fabric. Without vBond, no device can bootstrap into the SD-WAN network.

MED, the optional non-transitive metric, is compared between routes from the same neighbouring AS; the lower value wins when earlier attributes such as weight, LOCAL_PREF and AS_PATH length tie. This matches the stem's condition that all other factors are equal.

The OSPF cost on this interface is explicitly configured to 50 using the 'ip ospf cost' command. This manual assignment takes absolute precedence over any automatically derived cost, so the router uses exactly 50 when computing the SPF metric for routes learned via this interface. Because the configured value is 50, it is the correct answer.

BGP keepalives are sent periodically (typically every 60 seconds) and matched by the CoPP BGP class because they are control-plane TCP traffic to/from port 179. If the policer's committed rate is exceeded—even briefly—the excess keepalives are dropped. After a few missed keepalives, the BGP hold timer (default 180 seconds) expires, causing the peer session to flap. The same policer can also drop BGP route updates, which may cause instability beyond just keepalives.

Policing enforces a 2 Mbps average rate using a token bucket; every arriving HTTP packet is evaluated against that bucket. Packets that find enough tokens are transmitted unchanged because of the conform-action transmit clause, while packets that exceed the bucket depth trigger the exceed-action drop and are discarded immediately. Policing does not buffer, so excess traffic is dropped rather than delayed.