ENCOR 350-401 (350-401) — Questions 1501–1575

To assign an IP address to the management VLAN, you enter interface configuration mode for VLAN 1 using 'interface vlan 1', then assign the IP address with 'ip address', and ensure the interface is up with 'no shutdown'. This is the standard method for configuring a management IP on a Cisco switch. VLAN 1 is the default management VLAN.

Client 360 provides a comprehensive view of a specific client's experience, including onboarding, connectivity, and application performance. It includes detailed metrics such as voice quality (MOS), packet loss, and latency. In this scenario, Client 360 would allow the administrator to drill down into the client's voice traffic and identify the root cause of poor voice quality.

The bandwidth of 2 Gbps (shown as 2000000 Kbit/sec) correctly suggests that two 1 Gbps links are aggregated into this EtherChannel. In an EtherChannel, the logical interface bandwidth is the sum of the bandwidths of all member links, and with two full-duplex 1 Gbps member ports, the combined bandwidth becomes 2 Gbps. This aligns with the expected output for a two-member PortChannel and confirms the aggregation is active.

In Cisco SD-Access, ISE authenticates users and assigns Scalable Group Tags (SGTs) to define policy; LISP serves as the overlay control plane, decoupling routing from endpoint location to support host mobility and scale. VXLAN is the data plane encapsulation that transparently carries traffic and embeds the SGT in its header for group-based enforcement at fabric edge nodes. TrustSec uses those SGTs rather than IP addresses to enforce security policies consistently across the fabric, which is exactly the intended role of each protocol in the architecture.

This option is correct because the VRF configuration includes both an IPv4 unicast and an IPv6 unicast address family, each with its own VRF table. Additionally, both address families are configured with the same route-target value of 65000:100 for both import and export. This means the VRF supports both IPv4 and IPv6 VPNs, and the matching route-targets ensure that routes from both address families are respectively imported and exported to the same VPNv4/VPNv6 neighbors.

NFV throughput depends on CPU and memory locality. Pinning vCPUs to dedicated physical cores prevents hypervisor scheduling contention, while sourcing memory from the same NUMA node avoids cross-node QPI/UPI hops that add latency and reduce packet-processing throughput for the CSR1000v.

This is the correct interpretation of the 'neighbor 10.0.0.2 timers 10 30' command. The syntax explicitly places the timers within the neighbor address family, meaning the keepalive interval of 10 seconds and hold time of 30 seconds are applied only to that BGP peer. This per-neighbor timer configuration overrides any global 'timers bgp' settings for this neighbor, and it does not affect other neighboring devices.

Setting a higher local preference on R1 for the default advertisement from ISP1 is correct because local preference is the first major BGP attribute used to choose the outbound path (after weight) and is propagated to iBGP peers. By assigning this route a higher local preference, R1 will prefer its directly received default from ISP1 over the alternate default route learned from R2, and that preference will also be advertised to R2 via iBGP, making ISP1 the primary egress for the entire AS. Local preference is evaluated before AS_PATH, MED, and IGP cost, so it is the most direct and scalable way to control outbound traffic policy.

Low Latency Queuing (LLQ) provides strict priority queuing for delay-sensitive traffic like VoIP. It includes a policer that limits the priority queue to a configured bandwidth, preventing it from starving other queues. This matches the requirement for strict priority treatment with policing of excess VoIP traffic, making it the correct choice.

The 'cache entries' command under the NetFlow cache configuration specifies the maximum number of entries that the NetFlow cache can hold. When the cache reaches this limit, the router may force-export older entries to make room for new ones. By increasing this value, the engineer can allow more entries to be stored, reducing premature exports. This directly addresses the issue of the cache filling up rapidly.

vSmart controllers establish control connections with edge devices over DTLS, or TLS where configured, protecting OMP route and policy exchanges. This satisfies the control plane security requirement distinguishing controller-to-edge signalling from the separate data plane tunnels.

Client 360 provides a detailed view of a specific client's connectivity, including onboarding, authentication, and application experience. It aggregates data from multiple sources to help identify why a client has a poor health score, such as RF issues, authentication failures, or DHCP problems. This is the correct tool for root cause analysis of a single client's health.

GigabitEthernet0/1 uses LACP active mode and GigabitEthernet0/2 uses passive mode, so the bundle negotiates successfully. The Port-channel1 interface is configured as a trunk permitting VLANs 10, 20 and 30, which is exactly what the port-channel carries.

With vlan dot1q tag native enabled, the switch tags all frames on the native VLAN. Any untagged frames arriving on the trunk are considered invalid and dropped. This is the expected behavior when this global command is used, and it explains why untagged frames are being dropped.

VXLAN EVPN relies on MP-BGP EVPN to advertise MAC and MAC-IP reachability between VTEPs. Without an established EVPN session and the corresponding type-2 routes for the VNI, leaf-1 does not know which remote VTEP owns the destination MAC, so it cannot encapsulate the frame toward leaf-2 and traffic is dropped even though the VNI is up.

SGACLs are evaluated on the enforcement device using the source and destination SGTs carried in the Cisco Metadata header. This allows the fabric to deny Contractor-to-Finance while permitting Contractor-to-Printers based on the policy matrix defined on Cisco ISE, satisfying the requirement precisely.

Correct. VLAN 100 is within the standard range of 1-1005.

The Chef client is the enforcement agent that runs directly on each managed device, including network infrastructure such as IOS XE, NX-OS, or IOS XR when Cisco devices are integrated with Chef. It performs the convergence loop by querying the Chef server for the node's run list, evaluating the current state using Ohai, and then executing resources to bring the device to the desired configuration. This on-device agent is precisely the component that applies the automated configuration, making it the correct answer.

AS_PATH is a well-known mandatory attribute, meaning every BGP UPDATE carrying reachable NLRI must include it, and all compliant speakers must recognise it. This satisfies the stem's requirement for a true statement about path attributes, as it correctly classifies both the well-known and mandatory characteristics.

Type 2 MAC/IP Advertisement routes carry the MAC address, IP address, and VTEP information for a host, allowing remote leaf switches to install the MAC into their forwarding tables without flooding. This route type is the core of EVPN MAC learning and enables efficient unicast forwarding across the VXLAN fabric. It directly satisfies the requirement for MAC reachability advertisement.

The command 'dot1x system-auth-control' enables 802.1X authentication globally on a Cisco switch. It is a prerequisite for configuring 802.1X on individual interfaces. Without this command, 802.1X authentication will not function, even if interface-level commands are configured. This command allows the switch to act as an authenticator and communicate with the RADIUS server to authenticate supplicants.

The intermittent BGP flaps during convergence indicate that legitimate BGP control traffic is exceeding the 8,000 pps police rate and being dropped by the exceed-action. Increasing the police rate or changing the exceed-action to transmit for the BGP class restores session stability while still policing other control plane traffic. Verification of the offered rate is essential to size the policer correctly.

In an SD-Access fabric, Cisco TrustSec enables ISE to assign an SGT to an authenticated IP phone, identifying it as voice even when its IP address changes. The fabric edge node, as the first hop for the voice traffic, can match that SGT and apply a policy that marks DSCP EF and places packets into the priority queue. Because SGT-based classification is independent of IP addressing, it scales cleanly and provides consistent queuing as the traffic traverses the fabric.

On Nexus 9000 switches, enabling the VXLAN feature allows the hardware ASIC to perform VXLAN encapsulation and decapsulation at line rate, avoiding supervisor CPU involvement. Configuring a distributed anycast gateway with the same virtual IP and MAC on every leaf provides optimal first-hop routing for tenant subnets. Together these features satisfy both the hardware-based VXLAN data plane and the anycast gateway design requirement.

Severity level 0 maps to emergencies, the highest priority, signalling that the system itself is unusable and requires immediate attention. This satisfies the stem's requirement for a correct syslog severity statement, since level 0 sits at the top of the eight-level scale, above alerts and critical conditions.

RADIUS hides only the password field within the Access-Request, leaving attributes such as username and service type readable. TACACS+ encrypts the whole packet body, including all authorisation and accounting attributes, using a shared secret over TCP port 49.

The 'local' method in an AAA login method list instructs the router to check credentials against the locally defined username database (created with the 'username' command). If the router has no usernames configured, there are zero valid usernames/passwords to authenticate against, so the login attempt fails immediately. This is true regardless of the method list name or whether aaa new-model is enabled. Thus the correct root cause is the empty local user database.

This snippet uses the correct RESTCONF URL for the hostname, sets the Accept header to 'application/yang-data+json', provides basic authentication credentials, and disables SSL verification. The JSON response for this leaf is a dictionary with the key 'Cisco-IOS-XE-native:hostname'. This correctly retrieves the hostname.

Separating BGP and SSH into distinct classes with independent policers allows the administrator to rate-limit BGP traffic tightly while guaranteeing SSH a separate, protected bandwidth allocation. Applying the policy-map globally under the control-plane configuration mode enforces policing on all control-plane traffic destined to the route processor, satisfying the requirement to prevent BGP floods from starving management access.

IGMPv2 is the correct default on Cisco IOS interfaces when multicast routing is enabled. It introduced the Leave Group message and a querier election mechanism, which makes group membership teardown much faster than IGMPv1, and these features are considered the baseline for IPv4 multicast on IOS. An interface with multicast routing (via a global 'ip multicast-routing' command) running IGMPv2 requires no additional version-specific configuration, so 'ip igmp version' is not present in the running config by default.

When an access port is configured with PortFast, it assumes only an end host is attached, and BPDU Guard is often enabled to protect the STP domain. If another switch connects and sends a BPDU, BPDU Guard immediately places the port in errdisable state, which matches the log's reference to BPDU Guard. This is the only option that explains why the port was disabled and why the log specifically cites BPDU Guard.

This correctly configures the port as an 802.1Q trunk, sets VLAN 10 as the native VLAN (untagged), and allows both VLAN 10 and VLAN 20 on the trunk. The AP can send management traffic untagged on VLAN 10 and tag client traffic for VLAN 20, exactly matching the requirements for the wireless deployment.

Rapid PVST+ runs a separate 802.1w instance per VLAN, so each VLAN's topology converges independently using rapid handshake proposals and agreements rather than timers. This satisfies the stem's requirement of faster convergence than classic 802.1D STP while retaining per-VLAN load balancing.

Path Trace is a Cisco DNA Center Assurance feature that allows you to trace the path of a flow between two endpoints, such as a client and a server. It provides hop-by-hop details, including device names, ingress/egress interfaces, and any ACLs or QoS policies applied. This is exactly what the engineer needs to analyze the traffic path and identify where issues may occur.

Ansible is a declarative, agentless automation tool that uses YAML playbooks and connects to devices over SSH. It does not require an agent on the managed device, making it ideal for network automation. The scenario describes exactly these characteristics.

The router is indeed performing Port Address Translation (PAT), also known as NAT overload. The key clue is that the translation entries are labeled "extended" — this means they include Layer 4 port numbers (TCP/UDP) in addition to IP addresses, allowing many inside hosts to share a single outside public IP. PAT is the standard mechanism for conserving IPv4 addresses in enterprise and home networks, and it is confirmed by the presence of extended dynamic translations in the output.

In Cisco SD-Access, the control plane is based on LISP (Locator/ID Separation Protocol). The map server and map resolver (often co-located on control plane nodes) maintain the mapping of endpoint identifiers (EIDs) to routing locators (RLOCs). This enables scalable endpoint registration and location without flooding, which is essential for large fabrics supporting thousands of endpoints.

In Cisco SD-WAN, the vEdge router must authenticate with the vBond orchestrator to obtain the list of vSmart controllers and establish control connections. This requires a valid certificate installed during onboarding. Without proper authentication, the vEdge cannot join the overlay network, even if IP reachability exists.

Devices remain in 'Pending' until the Provision workflow is explicitly run; creating and assigning the network profile only defines intent. Cisco DNA Center does not push configuration automatically on assignment, so the engineer must select the devices and execute Provision to deploy the configuration and clear the pending state.

Enabling PortFast on a switchport causes it to bypass the STP listening and learning states and transition directly to forwarding, which is appropriate for host-facing access ports. If BPDU Guard is also enabled on that port, any received BPDU—which should never arrive from an end host—is treated as a misconfiguration, and the port is immediately placed into the error-disabled state. This protects the access domain from accidental loops or rogue switch connections, and the port stays in error-disable until manual intervention or an errdisable recovery timer is configured.

Jinja2 is a text templating engine, so variables, for loops, and if conditionals let one template generate many device-specific configurations. This satisfies the scenario's templating requirement, unlike plain string concatenation, which cannot express conditional or repeated configuration blocks.

The interface-level ip ospf cost 10 overrides the reference-bandwidth calculation on GigabitEthernet0/0, fixing its cost at 10. GigabitEthernet0/1 has no explicit cost, so IOS-XE derives the default from its bandwidth. Both interfaces fall within network 10.0.0.0 0.255.255.255 area 0.

The low-power profile in Cisco APs selects a lower transmit power level (for example, level 5 as opposed to level 1), which directly reduces the RF power emitted by the AP. This shrinks the cell coverage area, allowing for denser AP deployment with less co-channel overlap and interference. It is purely a transmit-power adjustment; it does not change channel width, data rates, or band.

The spine layer is the fabric's core, aggregating all leaf switches, so it must have high port density to terminate connections from every leaf, and high forwarding capacity (throughput and packet-per-second) to handle the aggregate east-west traffic without oversubscription. As a Layer 3 router, each spine forwards IP packets between subnets using the routing table, not MAC addresses, and leverages Equal-Cost Multipath (ECMP) to spread flows across all available leaf links. This makes the spine the critical scale and performance bottleneck in the design.

The global configuration command 'vlan 100' creates VLAN 100 and enters VLAN configuration mode, allowing optional parameters such as a name or MTU to be applied. This is the standard and correct method to create a VLAN on modern Cisco IOS switches, as it directly adds the VLAN to the switch's VLAN database and running configuration. Without this command, other VLAN-related commands have no VLAN to act upon.

The output shows a 'dead total' of 3 for 192.168.1.20, meaning the server has been marked dead three times. Additionally, the retransmit count of 2 indicates that on at least one occasion, two retransmissions were necessary before a response, suggesting intermittent performance or failure. While the server is currently UP, this historical data confirms past unreachability or timeouts.

Live migration achieves near-zero downtime by iteratively copying memory pages to the destination while the VM keeps running, then briefly pausing to transfer the final dirty pages and CPU state. This satisfies the stem's requirement that the VM continues to run throughout the migration.

The interface-level command ip ospf authentication message-digest enables MD5 authentication for OSPF on that interface. The ip ospf message-digest-key command defines the key ID and MD5 key. Together, they satisfy the requirement to authenticate neighbors using MD5 without sending the key in clear text.

Each VLAN configured for HSRP creates a separate HSRP group, and the standby switch must process multicast hello packets (normally sent every 3 seconds) for every one of those groups. With hundreds of VLANs, the cumulative volume of hello packets—each requiring CPU interrupt handling, state-machine updates, and authentication checks—can saturate the control plane and manifest as CPU spikes. This makes HSRP hello processing the most plausible cause of standby CPU utilization in a large L3-access design.

VRF-lite achieves path isolation by giving each VRF a separate RIB and FIB, so overlapping prefixes between tenants never conflict. This satisfies the requirement for independent per-VRF forwarding decisions on a single physical device, without MPLS labels.

The MACsec Key Agreement protocol negotiates session keys between peers using a connectivity association key, which can be provided statically or derived through 802.1X. Without a successful MKA session, the link will not pass protected traffic. This key management layer distinguishes MACsec from simple link encryption and ensures both ends agree on cipher suites and key material.

In GETVPN, the key server (KS) defines which traffic is encrypted by creating a group policy that includes an extended access-list as the traffic selector. If this ACL is missing, the KS has no 'interesting traffic' to bind to the GDOI security association, so even though GMs may register successfully, they receive no encryption policy. As a result, no traffic is encrypted between GMs.

The fabric edge node is responsible for encapsulating traffic from wired endpoints using VXLAN and forwarding it to the fabric. It acts as the first-hop router for endpoints and registers them with the control plane node. This component is essential for wired client integration in SD-Access, as it provides the anycast gateway and encapsulation functions.

A Remote Destination Session is configured on the switch that terminates the RSPAN session. This switch has source RSPAN VLAN 100, meaning it receives mirrored frames from that VLAN and copies them out Gi1/0/15, which is the analyzer port. The destination port is an egress-only monitor port, so the statement accurately describes the data flow.

MPLS forwarding is label-swapping driven: the LFIB maps an incoming label and interface to an outgoing label and next hop, and the router consults it for every labelled packet. This makes the LFIB the authoritative data plane structure for forwarding decisions.

This is correct. 'switchport nonegotiate' completely disables DTP after 'switchport mode trunk' is configured, so no DTP frames are sent or processed. The interface remains a statically configured trunk, because nonegotiate only suppresses trunk negotiation and does not alter the forced trunk mode.

This configuration sets the port as a trunk, matches the native VLAN to 999, and restricts allowed VLANs to 50. It aligns with the distribution switch configuration, ensuring native VLAN consistency and limiting traffic to the management VLAN. This meets both requirements exactly.

Stub areas block Type 5 AS External LSAs at the ABR, preventing external flooding, while Type 3 Summary LSAs still enter and the ABR injects a default route. This matches the stated stub behaviour exactly.

In a port running 802.1X, the switch treats the phone as an endpoint that must authenticate before the voice VLAN is applied. Because the phone cannot run the 802.1X supplicant and MAB is not enabled, the switch never receives a successful authentication to classify the device as voice, so the port remains in the unauthorized state and the locally configured `switchport voice vlan` is not assigned. The phone therefore stays on the data VLAN or gets no usable VLAN.

RESTCONF supports the PATCH method to apply partial modifications to a resource. When using PATCH with a JSON payload, only the specified fields are altered, leaving other existing configuration intact. This is ideal for changing a single interface description without overwriting the entire interface configuration. The payload must be structured according to the YANG model, targeting the specific leaf to be modified.

Multi-host mode allows multiple hosts to connect to a single port, but only the first host is authenticated. Once that host is authenticated, all other hosts are granted access without individual authentication. This matches the scenario where multiple hosts are allowed but only one host should be authenticated, making it the correct command.

Assurance relies on streaming telemetry pushed from devices, not SNMP polling. IOS-XE switches need NETCONF/YANG or model-driven telemetry configured; without it, DNA Center receives no health data even though the devices remain reachable and manageable.

The <edit-config> operation is used to modify the configuration in a target datastore. It supports operations like merge, replace, create, and delete. The engineer would use this to apply changes to interface configurations. It is the core operation for making configuration changes via NETCONF and is required to fulfill the modification requirement.