ENCOR 350-401 (350-401) — Questions 1876–1923

A guest anchor controller allows guest traffic to be tunneled from the foreign controller to a designated anchor controller in the DMZ. This isolates guest traffic from internal networks and fulfills the requirement to tunnel guest traffic directly to the DMZ.

StackWise Virtual combines two Catalyst 9000 switches into one logical entity with a single management IP and one configuration file. Both switches actively forward traffic in an active-active fashion using a virtual switch link, which exactly matches the requirement for one logical control plane and dual active forwarding in a collapsed core design.

The value 0 in the State/PfxRcd column means the BGP session with 10.0.1.4 is fully established (otherwise a state word would appear), but R1 has not received any network-layer reachability information from that neighbor. This situation occurs when 10.0.1.4 has no routes to advertise, or an outbound route-map, prefix-list, or filter is suppressing its advertisements. Since the session is up, the lack of prefixes is a routing-policy outcome, not a session failure. Thus, the neighbor is simply not advertising any prefixes to R1.

A stub area is the correct choice because it filters out Type 5 (external) LSAs, preventing the router from learning external routes. Instead, the ABR automatically injects a default route (0.0.0.0/0) into the stub area, which routers use to forward traffic to destinations outside the OSPF domain. This satisfies the requirement of not learning external routes while still allowing full outbound connectivity.

Fabric edge nodes encapsulate traffic in VXLAN and enforce group-based policy using Cisco TrustSec security group tags and scalable group ACLs derived from ISE policy. When a guest wireless user tries to reach an EHR server, the ingress edge node drops the packet based on the source and destination security group tags. This directly delivers the required isolation between guest and clinical traffic in the SD-Access fabric.

The running configuration includes the command 'aaa accounting exec start-stop group radius', which directs the router to generate a start accounting record when a user initiates an EXEC session (such as SSH or console) and a stop record when that session ends. The 'exec' keyword specifically applies to user shell sessions, not to network services like dot1x or VPN, and 'group radius' identifies the RADIUS server group as the destination. This matches the output and is the correct interpretation.

Correct. In standard eBGP, the IP TTL of BGP packets is set to 1 by default, meaning the neighbor must be directly connected at the link layer. The `ebgp-multihop 2` command increases the TTL to 2, letting the BGP update traverse one intermediate router and enabling the session to an eBGP peer that is not directly connected. This is commonly used when peering between loopback interfaces for resilience or when the peer is reachable through a multihop path.

StackWise Virtual requires a dedicated StackWise Virtual Link (SVL) between the two switches using supported high-bandwidth ports, and both switches must run identical software versions to form a single logical entity. This ensures control plane synchronization and consistent forwarding behavior, which is essential for the domain to operate correctly.

In OSPF, DR/BDR election on broadcast multi-access networks is determined by the interface priority (range 0-255). Setting the 'ip ospf priority 0' command on every local interface makes the router ineligible to ever be elected as DR or BDR, because OSPF only considers routers with a non-zero priority as candidates. This is the standard, granular way to prevent a specific router from taking that control-plane role without altering the network type or affecting other routers' eligibility.

Authentication Header (AH) is an IPsec protocol that provides authentication and integrity but does not provide encryption. It ensures that the data is from a legitimate source and has not been altered. In the scenario, AH can be used for authentication, but it does not encrypt the traffic.

In NETCONF, the 'merge' operation combines the configuration data in the RPC with the existing configuration. For a leaf node like the IP address, which is a single instance, the new value overwrites the existing value. The interface will end up with only the new IP address 10.1.1.2/24. This is because the merge operation updates the leaf with the provided value, effectively replacing the old one.

This command configures AAA authentication for login using the default method list. It specifies that the TACACS+ group should be tried first, and if the server is unreachable, the local database is used as a fallback. This meets the requirement for fallback authentication. The 'group tacacs+' keyword refers to the TACACS+ servers defined with the 'tacacs server' command.

Shutdown mode places the port into an err-disabled state immediately upon a violation, stops all forwarding, generates a syslog message, and increments the violation counter. Recovery requires manual intervention (or err-disable recovery configuration), matching the scenario's requirement that the administrator re-enable the port after investigation. This is the classic default violation mode on Cisco Catalyst switches and satisfies every stated condition.

OSPF E2 routes advertise the external metric from the ASBR and intentionally discard the internal cost accumulated along the path, so two E2 routes with the same metric appear equal. However, Cisco IOS and many other implementations avoid a random choice by applying a tie-breaking rule: when the E2 metric and AD are identical, the router compares the OSPF interface cost (or the cost to the ASBR) and prefers the path with the lower cost. In the exhibit, the two E2 routes have equal external metrics, but the route via the interface with lower cost is installed, while the other is held as a candidate. Thus, the apparent equal-cost routes are not truly equal for forwarding because interface cost breaks the tie.

The Cisco Catalyst Center Intent API requires the authentication token to be passed in the HTTP header 'X-Auth-Token'. If the token is included in the body or as a query parameter, the API will reject the request with 401 Unauthorized. The engineer must set the header correctly. This is a common mistake when first using the API.

The debug output shows the RADIUS server 10.1.1.10 responding to the authentication request with a PASS response, which is the RADIUS Access-Accept message. This confirms that the server successfully authenticated the user, and the router accepts the session. The output also identifies the username as 'admin' and marks the authentication as successful with 'Pass,' so the correct answer is that the RADIUS server authenticated the user successfully.

The tracker polls the referenced IP SLA operation's return code and transitions between up and down accordingly, so downstream features react to probe failure. This satisfies the stem's requirement that a tracking object monitor operation state and change state on failure.

The TACACS+ server responded with a PASS result for the authorization request, which signifies that the user jdoe was authorized successfully. In TACACS+, the server sends a set of AV-pairs along with the PASS result, defining the user's permitted commands or services. This output confirms that the server granted the user the requested authorization.

The confirmed-commit capability enables a commit operation that must be confirmed within a specified timeout; if confirmation does not occur, the device automatically reverts to the previous configuration. This provides the automatic rollback behavior the engineer needs. Without this capability, a failed or unconfirmed commit would leave the device in the new configuration state, so verifying its advertisement is essential for atomic, safe changes.

In Cisco ACI, a tenant is the top-level logical container that provides administrative, fault, and policy isolation. Endpoints, EPGs, VRFs, bridge domains, and contracts all reside within a tenant, and traffic between different tenants is blocked by default unless an explicit contract establishes a communication path. This is why tenant, not any sub-tenant construct, is the correct answer for the entity that isolates traffic between separate organizations or departments.

The login block-for feature, often called Login Enhancements, monitors failed login attempts against the router's local authentication and, when the threshold is exceeded within the configured window, places a temporary ACL that blocks all further login attempts from offending sources for the quiet period. It protects the router's control plane without affecting transit traffic, matching the stated requirement exactly.

The fabric control-plane node runs LISP map-server and map-resolver functions. Fabric edge nodes register endpoint EIDs with it, and it answers EID-to-RLOC map requests so that edge nodes can build VXLAN tunnels to the correct destination. In this design it is the component that owns identity-to-location mapping, satisfying the requirement stated in the scenario.

Client 360 provides a comprehensive view of a specific client's experience, including connection history, onboarding issues, and performance metrics. It correlates data such as association failures with client device type, operating system, and location, enabling the administrator to identify patterns and root causes of wireless connectivity problems.

In Cisco SD-Access, a Virtual Network (VN) is a logical partition that provides Layer 3 isolation. Each VN is associated with a VRF, and endpoints in different VNs cannot communicate at Layer 3 unless there is a fusion router or external policy. This meets the requirement for department isolation while sharing the physical underlay.

The fabric border node is the correct answer because it serves as the gateway between the SD-Access fabric and external networks (such as a data center or WAN). Critically, border nodes can apply policy-based routing (PBR) to inter-VN traffic, allowing it to be steered to an external firewall for inspection before being allowed to continue — a capability that makes the border node the natural point for inter-VN policy enforcement. In Cisco SD-Access, border nodes also perform LISP proxy-ETR (PETR) and proxy-ITR functionality, enabling them to handle traffic destined outside the fabric and to apply security policy at the network edge without needing a dedicated internal firewall. Thus, the border node is specifically designed to enforce inter-VN security policy, not just forward traffic.

Correct. Spine-leaf provides predictable latency for east-west traffic because every leaf-to-leaf path crosses exactly one spine switch, giving a consistent hop count of two (leaf-to-spine-to-leaf) regardless of which leaf pair communicates. This uniform topology yields low, bounded, and predictable latency, unlike hierarchical designs where traffic may traverse multiple aggregation and core layers with variable distances. It is a key reason spine-leaf suits latency-sensitive data center applications.

BGP's best-path algorithm evaluates attributes in a fixed order: after comparing Weight, Local Preference, and locally-originated paths, it selects the route with the shortest AS_PATH. Here Path #2 carries only AS 65050 in its AS_SEQUENCE, giving it a path length of 1, while Path #1 lists 65050 65100, a length of 2. Because AS_PATH comparison occurs before any tie-breaking steps, Path #2 wins as the best path solely based on this shorter AS path.

vlan 100 is the global configuration command that creates a new VLAN with ID 100 and immediately enters VLAN configuration mode. This is the required first step when establishing a new VLAN, as it adds the VLAN to the switch's local VLAN database. From this mode, you can set optional parameters such as the VLAN name, MTU, or other interface-specific settings. Issuing this command makes the VLAN available for subsequent operations like assigning access ports or creating an SVI.

The Status column shows WLAN 3 as Disabled, meaning the WLAN is administratively shut down and will not broadcast or accept client associations. Its SSID, security and interface settings remain configured but inactive until the WLAN is enabled.

Telnet from 192.168.1.0/24 matches entry 20 (deny), and SSH from 10.0.0.0/8 does not match entry 30 (which permits only from 172.16.0.0/16), so it matches entry 40 (deny).

Type 1 Router LSAs are originated by every OSPF router to advertise its own active interfaces and connected neighbors, including link type, link ID, interface IP, and metric. These LSAs are always confined to the area in which they are generated and form the base graph that Dijkstra's SPF algorithm processes. Because every router must describe itself before any other LSA can be interpreted, Type 1 is the most basic and essential LSA type.

The 'xof' keyword in IP SLA reaction configuration defines the number of consecutive threshold violations needed to trigger an event. Here, 'xof 5' means five RTT probe samples in a row must each exceed 100 ms; if any single probe falls back below the threshold, the consecutive counter resets to zero. Only after those five uninterrupted high measurements does the event fire.

For inbound traffic to reach an internal web server, the router must translate the public destination IP back to the server's private IP. This requires an explicit ip nat inside source static command (or the TCP/UDP port-specific variant) that defines the one-to-one binding between the public address and the private address. Without this command, the router has no entry in its NAT table for the destination address and will drop the packets, so external clients cannot connect.

In classic EIGRP configuration, the network command with a wildcard mask (e.g., `network 192.168.1.0 0.0.0.255`) matches only the specific subnet 192.168.1.0/24, while a plain classful `network 10.0.0.0` matches all interfaces with any address in the 10.0.0.0/8 range. Therefore EIGRP is enabled precisely on those interfaces, and the router will begin forming adjacencies only on interfaces that match either statement.

The IP SLA DNS probe is designed to send a DNS query to a specified server and measure the response time. If the router's DNS resolver has caching enabled and has previously resolved the queried name, it may answer from its local cache without ever transmitting the query to the configured DNS server. This results in a successful probe with a low RTT (e.g., 50 ms) even when the actual DNS server is unreachable, because the reply comes from the router itself. To avoid this, the DNS name used in the probe must be unique or DNS caching must be disabled to force an end-to-end query.

A YANG interface module carries a description leaf holding free-text administrative annotation for the interface. It is a standard configurable attribute alongside administrative state and addressing, making it one of the three expected interface attributes.

StackWise Virtual pairs two physical switches into a single logical device over a StackWise Virtual Link. Unlike classic StackWise with a master and members, both chassis run independent control planes that stay synchronized, and Multichassis EtherChannel to downstream devices is supported.

AP channel utilization and interference metrics show how congested the wireless channel is and whether external interference is present. High channel utilization or interference can cause high retry rates and low SNR. DNA Center Assurance provides these metrics per AP and band, enabling the engineer to identify if the issue is due to co-channel interference or a noisy environment.

NetFlow provides detailed information about IP traffic flows, including source and destination IP addresses, ports, protocol, and byte counts. When enabled on an interface and exported to Cisco DNA Center, it allows the administrator to identify which applications are consuming the most bandwidth. This is the correct feature for application visibility and bandwidth analysis.