ENCOR 350-401 (350-401) — Questions 1726–1800

A virtual switch connects virtual NICs within the hypervisor and forwards frames between them based on MAC addresses, giving each virtual machine its own vNIC and MAC. Virtual machines placed on different virtual switches or port groups remain isolated unless an uplink or explicit connection joins them, matching the requirement.

All physical ports in a Layer 2 EtherChannel must have identical switchport characteristics, including the switchport mode. Because Gi0/1 is configured as trunk and Gi0/2 as access, the ports fail the EtherChannel consistency check, so PAgP/LACP will not place both ports into a working bundle. Correcting the mode on both members to either trunk or access is mandatory before the port-channel interface can become operational.

Preempt lets this switch seize the active role once its priority exceeds the current active router's, rather than waiting passively. With priority 150 configured, it reclaims the virtual IP 10.0.0.1 after recovering from a failure, satisfying the requirement to restore the preferred gateway automatically.

When OSPF cost changes are deployed simultaneously across multiple routers without a convergence interval, each router temporarily holds a different version of the link-state database (LSDB). This inconsistency causes the Shortest Path First (SPF) calculations on different routers to produce divergent, potentially looping paths until LSAs are fully flooded and SPF re-runs on all nodes. The correct practice is to stage changes incrementally, allowing each LSA to propagate and the SPF recalculation to complete before the next cost modification is applied.

The feasible distance (FD) is the best metric to a destination in EIGRP, computed by taking the metric reported by the next-hop router (the advertised distance, or AD) and adding the local link cost to that next hop. This sum yields the total end-to-end metric from the local router to the destination via the successor. The successor is chosen precisely because it minimizes this composite value, making the FD the definitive metric for route selection and for verifying loop-free paths in DUAL.

This answer is correct because the class-map references an access control list (ACL) that selects specific control-plane traffic, and the police command in the policy-map enforces a committed information rate (CIR) of 1 Mbps. When a packet matches the ACL, it is evaluated by the token bucket; conforming traffic is transmitted, while non-conforming (excess) traffic is dropped due to the configured exceed-action drop. This rate limiting is therefore applied narrowly to only the ACL-matched subset of control-plane traffic, not to all traffic or any other class.

This answer is correct. The command's 'auth-port 1645' and 'acct-port 1646' keywords explicitly set the RADIUS authentication and accounting UDP ports, respectively. These non-default ports are commonly associated with legacy RADIUS implementations and are fully supported by Cisco IOS. By specifying these values, the device will send RADIUS packets to UDP 1645 for authentication and UDP 1646 for accounting, overriding the IANA defaults of 1812 and 1813.

Cisco SD-Access uses a fabric with a centralized control plane (LISP) and distributed data plane (VXLAN), enabling seamless mobility and preventing traffic tromboning by allowing edge nodes to forward traffic directly. This matches the requirement for centralized control and distributed data plane.

VTP uses the highest revision number within the same domain and password to determine which database is most current. SW2 has a higher revision number, so SW1 will accept SW2's advertisement and overwrite its own VLAN database with SW2's, which is empty. This can wipe out all VLANs on SW1 and disrupt the network.

EVPN uses MP-BGP with the L2VPN EVPN address family to advertise MAC addresses, IP-to-MAC bindings, and VTEP reachability in a VXLAN fabric. Enabling this address family in the leaf's BGP configuration lets the switch exchange Type 2 and Type 3 routes with the spine route reflectors, which is exactly the overlay control plane required here.

The correct selection is the path from 10.0.1.3 because it carries a local preference value of 200, which is higher than the 100 on the path from 10.0.1.2. Local preference is a well-known discretionary attribute that is advertised to iBGP peers and is the first major criterion compared after weight, so a higher value directly makes this route more preferred for outbound traffic. Thus, even if the other path came from a more specific or more attractive metric, the local preference overrides those later attributes.

Route leaking is the process of importing routes from one VRF into another, including the global routing table. By configuring route targets or using static routes with the global keyword, you can leak routes between a VRF and the global table. This allows traffic from the VRF to be routed to the internet via the global table, provided that the global table has a route to the destination.

This command statically populates the IGMP group membership table for group 239.1.1.1 on this interface. As a result, the multicast routing process treats the interface as having a group member and adds it to the outgoing interface list (OIL) for that group in the multicast route entry. Even if no IGMP hosts ever send reports on this segment, multicast packets for the group are still forwarded out of the interface. This is a standard way to simulate a receiver for testing or to guarantee delivery to a network that lacks IGMP-capable hosts.

MSTP maps many VLANs onto a shared instance, so a single spanning-tree computation serves them all. That collapses per-VLAN STP processing into fewer instances, directly cutting CPU and memory load compared with PVST+ running one tree per VLAN.

Syslog messages generated on the router itself are stamped with the router's system clock before being written to local logs. If the clock is not synchronized via NTP or has not been manually set correctly, every log entry will carry the wrong date and time. This directly matches the symptom of incorrect local log timestamps, making it the correct root cause.

In Cisco SD-Access, the control plane node runs the LISP map-server and map-resolver functions. It maintains the endpoint-to-location mappings in its database. When an edge node needs to resolve an endpoint's location, it queries the control plane node, which returns the RLOC (routing locator) of the edge node where the endpoint is attached.

DTP mode desirable actively sends DTP frames to form a trunk; it can form a trunk with a neighbor set to trunk, desirable, or auto.

In VXLAN, BUM traffic can be replicated using multicast in the underlay. By mapping each VLAN to a unique multicast group address, VTEPs can efficiently forward BUM traffic only to interested VTEPs. Configuring PIM Sparse Mode in the underlay enables this multicast replication. This approach optimizes BUM traffic by avoiding unicast head-end replication and leverages the underlay multicast capabilities.

In Protocol Independent Multicast Sparse Mode (PIM-SM), when a source sends multicast traffic to a group with unknown or no downstream receivers, the first-hop router (FHR) encapsulates each original multicast packet into a unicast PIM Register message and sends it to the rendezvous point (RP). This tunnel interface, often named Tunnel0, serves as the virtual point-to-point link for that encapsulation, carrying the multicast payload inside unicast PIM packets. The RP decapsulates these messages, learns the source's existence, and then can join the shortest path tree toward the source.

GigabitEthernet0/1 is the root port on SW4. In STP, a non-root bridge selects the single port that receives the best (lowest-cost) BPDU from the root bridge, and that port is assigned the Root role. Because the output shows Gi0/1 with role 'Root', it is the path toward the root bridge, even though SW4 itself is not the root bridge.

Control Plane Policing (CoPP) uses a modular QoS CLI policy applied to the control plane interface to rate-limit or drop traffic destined to the route processor. It allows granular classification of traffic types such as routing protocols, management access, and ICMP, while permitting unmatched traffic to pass, which matches the requirement exactly.

The control plane node in SD-Access runs LISP map-server and map-resolver functions. It maintains the mapping database of endpoint EIDs to RLOCs (fabric edge node locators). When an edge node needs to reach an endpoint, it queries the control plane node, which resolves the EID to the correct RLOC. This enables communication across fabric edge nodes.

SSL VPNs operate over TLS, the successor to SSL, encrypting the session between client and server at the transport layer. This satisfies the stem's requirement for a true statement about SSL VPNs, since TLS provides the cryptographic tunnel without requiring IPsec or dedicated client software in clientless deployments.

VLAN 10 must exist in the local VLAN database on both switches before traffic can cross an 802.1Q trunk. If one switch lacks VLAN 10, that switch will not forward tagged frames for that VLAN, even though the trunk interface is administratively up and the VLAN is in the allowed list. The switch will not create the VLAN dynamically unless VTP is in server mode and advertises it, so the missing database entry is the root cause.

To enable VXLAN encapsulation, the `feature nv overlay` and `feature vn-segment-vlan-based` must be enabled, and an NVE interface must be configured with a source interface (usually a loopback) and a VNI mapped to the VLAN. The NVE interface is the VTEP, and without it, VXLAN encapsulation does not occur.

When the 'central-switching' command is present, the AP encapsulates all client 802.11 frames in CAPWAP and sends them to the WLC for forwarding at the network layer. This central switching model places the WLC in the data path for all client traffic, which is exactly the behavior described in this correct option. Therefore, client traffic flows through the WLC rather than being bridged at the access point.

This is the root cause: `ios_acl_interfaces` requires `direction` to be literally `in` or `out`, and `outbound` is not a valid enum value. If the module does not immediately raise an argument-spec error, it may silently fall back to the default direction, which is `in`, thereby applying the ACL to inbound traffic. The observed behavior matches exactly: the ACL is active but filtering the wrong direction. Correcting the value to `out` would produce the intended outbound traffic filtering.

This is the correct global configuration command for setting the source IP of SNMP traps. It instructs the router or switch to use the IP address of Loopback0 as the source address in the IP header of every trap (and inform) packet. Because a loopback interface is always reachable and never goes down, unlike a physical interface, this ensures the NMS sees a stable, predictable source IP, which is especially useful for filtering and device identification.

EtherChannel formation requires that both the local and partner ports be in an 'up' state; in the output, Gi0/2 shows both local and partner states as 'down', which is the classic symptom of a physical-layer failure—e.g., a bad cable, unplugged fiber, or administratively down interface. Since the partner cannot receive or transmit LACP/PAgP PDUs, the negotiation fails and the port is not added to the bundle. Thus, the root cause is a Layer 1 problem, not a configuration mismatch.

YANG is a data modeling language used to define the hierarchical structure of configuration and state data in a device. It describes nodes, types, and constraints, allowing controllers and applications to understand the data that NETCONF retrieves and modifies. This is the core purpose of YANG, separate from transport or encoding details, and it is correct because YANG models the data, not the protocol messages.

The when clause is the standard Ansible mechanism for per-host conditional execution; it evaluates a Jinja2 expression against facts such as ansible_net_version, and if the expression is false, the task is skipped entirely for that host. For network devices, facts must first be gathered via a module like ios_facts, which populates ansible_net_version with the IOS image version. Using 'when: ansible_net_version is version('16.9', '>=')' is the correct, declarative way to run the SNMP task only on devices matching the version criteria.

The command `switchport trunk allowed vlan except 100-200` starts from the default allowed list, which includes all VLANs (1-4094), and subtracts VLANs 100 through 200 from that set. As a result, the trunk forwards traffic for every VLAN outside this range, including the native VLAN and any user-configured VLANs beyond the excluded block. This is the standard behavior of the `except` keyword: it creates a deny list rather than an allow list.

The access-list referenced by 'ip nat inside source list' identifies the traffic that will be translated, while the accompanying pool or interface keyword defines the translation method, such as dynamic NAT, PAT, or static mapping. The ACL matches source IP addresses and the subsequent parameters determine how those addresses are translated. Therefore, this command properly ties the match criteria to the translation action.

Ansible roles enforce a fixed directory layout — tasks, handlers, vars, defaults, meta, templates and files — so content is discovered automatically by convention rather than declared in the playbook, enabling reuse and clean separation of variables from defaults.

Cisco DNA Center is the centralized management, automation, and assurance platform that SD-Access is built around. It provides the intent-based fabric provisioning workflows that automatically configure fabric domains, control-plane nodes, border nodes, and edge nodes, while also orchestrating policy definitions and translating business intent into network configuration. Without DNA Center, the fabric underlay and overlay cannot be deployed as a cohesive SD-Access architecture, making it the correct management platform for the fabric.

Configuring a single standard virtual switch with separate port groups for each VM and assigning unique VLAN IDs isolates traffic at Layer 2 by ensuring that frames from one VM are tagged with its designated VLAN and cannot be forwarded to a VM in a different VLAN segment, as the virtual switch enforces VLAN boundaries at the virtual port level. This approach allows all tenants to share the same physical NIC(s) while keeping broadcast, multicast, and unicast traffic constrained to the assigned VLAN, meeting the isolation requirement without additional hardware.

The lowercase 's' flag on Gi0/2 means the port is suspended from the EtherChannel bundle, not forwarding traffic. A port is suspended when its configuration parameters—such as speed, duplex, trunk allowed VLANs, or native VLAN—do not match the other members of the port-channel. To protect the network from loops or misforwarding, the switch holds the port in a suspended state until its settings are reconciled with the bundle. This matches the correct answer.

The correct reason is that LDP binds labels only to prefixes that are actively installed in the global routing table (RIB). In this scenario, even though OSPF may be advertising the routes through neighboring routers, those specific destinations are absent from the router's RIB, so there is no forwarding equivalence class (FEC) for LDP to assign a label binding to. Since LDP is a pure RIB consumer, any route missing from the global table—due to filtering, administrative distance issues, or passive interfaces—will never receive a label.

Path #1 wins on AS_PATH length, the fourth BGP best-path attribute after weight, local preference and locally originated routes. Its AS_PATH contains two autonomous systems (65050, 65100) versus three for path #2 (65050, 65100, 65200), so the shorter sequence is selected as best, satisfying the tie-break at that step.

gRPC's transport is HTTP/2, enabling multiplexed streams over one connection, while Protocol Buffers define the service contract and serialise payloads compactly. This satisfies the stem's requirement for accurate model-driven telemetry statements, since gNMI itself is built as a gRPC service using these same mechanisms.

The vSmart controller is the centralized control plane component in Cisco SD-WAN. It distributes routing and policy information to WAN edge devices using the Overlay Management Protocol (OMP). This enables secure tunnel establishment and consistent policy enforcement across the fabric, making it the correct answer for orchestrating the control plane.

gNMI runs over gRPC and provides streaming telemetry, satisfying the stem's requirement for a protocol supporting continuous data collection. Unlike SNMP polling or syslog push, gNMI's subscribe operations deliver model-driven updates on change, which is precisely the telemetry streaming capability the question asks you to identify.

HSRP uses a virtual MAC address of 0000.0c07.acXX, where XX is the group number in hexadecimal. It also allows the virtual IP address to be the same as one of the physical interface addresses on the active router. This matches the requirements exactly, making HSRP the correct choice.

During the EXSTART/EXCHANGE phase, OSPF routers exchange database description (DBD) packets that can be as large as the interface MTU; if one router's MTU is lower, the larger DBD packet will be dropped or fragmented, and the neighbor will never leave EXSTART because it keeps waiting for a valid DBD sequence. The interface MTU mismatch is a classic cause of OSPF adjacencies stuck in EXSTART, as the router with the smaller MTU silently discards the oversized multicast packets. This can be diagnosed by checking the 'show ip ospf neighbor' state and by ensuring both ends have the same MTU or by enabling 'ip ospf mtu-ignore' as a workaround.

The control plane node in Cisco SD-Access maintains the mapping database of endpoint IP addresses to fabric locators (such as VTEP addresses) and provides the control plane that fabric edge nodes use to resolve endpoint locations. It uses LISP to register and query endpoint information, enabling separation of policy from topology. This directly matches the requirement described.

Centralized QoS policies in Cisco SD-WAN are defined in vManage and propagated by vSmart to every WAN edge router, ensuring identical classification and scheduling behavior across all transports. Matching VoIP DSCP EF markings and assigning them to a priority queue in the policy reduces latency and jitter for real-time traffic, which is the architecturally correct approach for fabric-wide uniformity.

In the 'show vlan brief' output, the Ports column for VLAN 1 lists Gi0/1, Gi0/2, and Gi0/3, which is exactly what identifies those interfaces as access ports in VLAN 1. Access ports are statically assigned to a VLAN and their membership appears in this list. Because trunk links are not displayed the same way as individual access members in this output, the listed interfaces are definitively VLAN 1 access ports.

The fusion router is used in SD-Access to provide inter-VN routing and to connect to shared services that reside outside the fabric or in a different VN. It allows multiple virtual networks to reach a common service without duplicating it. It is typically connected to the border node and runs VRF-aware routing to leak routes between VNs.

Ansible network modules for NX-OS require the connection variable to be set to 'network_cli' so that the module can establish a persistent SSH session to the network device. In addition, 'become: yes' with 'become_method: enable' is needed to enter privileged exec mode, otherwise the module cannot execute configuration commands. Omitting these directives means the playbook will fail or the module will be unable to apply the VLAN configuration.

Correct. GigabitEthernet0/0 is not passive, so it will send and receive hellos. GigabitEthernet0/1 is passive by default.

The border node in Cisco SD-Access provides connectivity between the fabric and external networks. It handles traffic entering and leaving the fabric, performing functions such as VXLAN-to-VLAN translation and routing to external networks. This allows external users to reach fabric endpoints.

YANG is a data modeling language used to model configuration and state data manipulated by NETCONF, RESTCONF, and other protocols. It is human-readable, hierarchical, and defines the structure, syntax, and semantics of data. YANG models are used by Cisco IOS XE and other vendors to expose their APIs. The engineer should choose YANG because it is specifically designed for this purpose and is the standard for model-driven programmability.

A cost of 2 is the correct path-cost value for a 10 Gbps link in the IEEE 802.1t short-method table. This value is part of the revised non-linear cost scale, where lower costs represent higher bandwidths, and 10 Gbps specifically corresponds to 2. Using this value ensures accurate Spanning Tree calculation for 10 Gbps interfaces, making it the right choice for the question.

Uplink ports bind a virtual switch to physical NICs, bridging guest VM traffic onto the wired network. This satisfies the stem's requirement for correct virtual switching statements, since without uplinks, VMs on the vSwitch could only communicate internally, isolated from the physical infrastructure.

The correct answer is confirmed by the routing table entry for VRF CUSTOMER-A. The prefix 10.0.2.0/24 is prefixed with 'B', which designates a route learned via the Border Gateway Protocol. The next-hop of 192.168.1.2 is the BGP peer address or an eBGP neighbor, proving that BGP is actively exchanging routes within this VRF. Additionally, the route is present in the VRF's isolated routing table, meaning the BGP session is associated with the VRF via the address-family configuration.

ESP (Encapsulating Security Payload) is the correct choice because it is designed to provide confidentiality via encryption, and it can also offer optional integrity and authentication for the protected payload. In tunnel mode, ESP encapsulates the entire original IP packet and encrypts its contents, making it unreadable to eavesdroppers. This makes ESP the standard IPsec protocol for secure VPN data transmission, as it directly satisfies the need for encryption.

A Layer 2 Outside (L2Out) is specifically designed to extend a Layer 2 bridge domain to an external Layer 2 network. It allows the ACI fabric to connect to external switches and forward Layer 2 traffic without routing. This is achieved by mapping the bridge domain to an external VLAN on the L2Out. Thus, L2Out is the correct construct for extending a Layer 2 bridge domain to an external Layer 2 network.

The SD-WAN OMP path-selection algorithm compares data-plane metrics such as loss, latency, and jitter for each transport tunnel, and a lower value is always preferred for loss and latency. Because the biz-internet path via 10.0.0.1 reports lower loss and lower latency than the 3G path via 10.0.0.2, it is selected as the active route. This metric-based choice is performed regardless of the underlying routing protocol used to transport the overlay.

The one-way delay measurement in an IP SLA UDP jitter operation is computed by subtracting the source router's send timestamp from the destination router's receive timestamp. If the two routers' clocks are not synchronized via NTP (or an equivalent time source), the calculated difference will be offset by the clock skew, which can easily produce a negative value. Without NTP, the timestamps are meaningless for absolute one-way delay, even though round-trip time would still be valid.

In 802.1X the switch port enforces authentication, relaying EAP frames between supplicant and RADIUS server, so it is the authenticator. This satisfies the framework role the stem asks about, distinct from the supplicant (client) and authentication server.

Under the 'immediate' threshold type, the IP SLA reaction fires as soon as a single RTT probe exceeds 200 ms. The 'triggerAndReset' action then resets the reaction counter to zero, enabling the condition to be re-triggered by the very next qualifying probe. This creates a repeating event stream for every individual crossing above 200 ms, rather than a one-time or sustained-detection alert. The IP SLA operation itself remains active and keeps generating probes, so each new violation is independently reported without administrative intervention.

The crypto ACL, typically an extended access list, defines the interesting traffic that should be encrypted and sent through the VPN tunnel. It specifies the source and destination subnets, such as permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255. This ACL is referenced by the crypto map.

Cisco ISE is the SDA identity and policy layer; during 802.1X, MAB, or web authentication it authenticates each endpoint and dynamically classifies it by assigning a Security Group Tag (SGT). The SGT is sourced from ISE and distributed to the fabric via RADIUS and pxGrid, so downstream devices use that tag rather than IP ACLs for consistent policy enforcement. Without ISE, no endpoint can be reliably associated with an SGT in a scalable SD-Access deployment.