ENCOR 350-401 (350-401) — Questions 151–225

Multicast routers enforce a Reverse Path Forwarding (RPF) check: a multicast packet is accepted only if it arrives on the interface that the unicast routing table would use to reach the source IP address. If the stream arrives on a non-RPF interface, the router discards it to prevent loops and duplicate delivery. This mismatch directly matches the described symptom of multicast traffic failing to forward, making this the correct explanation.

This operation is configured with a frequency of 15 seconds, meaning an ICMP echo request is sent every 15s. The reaction-configuration uses 'react timeout' with 'threshold-type immediate', so as soon as an echo reply is not received within the timeout period, the trigger fires immediately. 'action-type triggerOnly' prevents the trigger from being re-armed, so the event is raised only once even if subsequent timeouts occur.

Ansible is agentless, uses SSH as its transport, and employs declarative playbooks. The ios_config module specifically manages configuration on Cisco IOS devices. It requires no software installed on the managed device, aligning perfectly with the requirement. This combination is widely used for network automation and directly satisfies the scenario's constraints.

Certificate-based IKEv2 authentication requires a trustpoint that defines the CA, an enrolled identity certificate, and an RSA key pair on the router. The IKEv2 profile then references authentication local rsa-sig and the trustpoint so the router can present its certificate and validate the peer's certificate chain. Without a properly enrolled trustpoint, the router cannot perform RSA signature authentication, so this element is mandatory for the design.

A class map defines the match criteria for traffic classification, and Cisco IOS supports matching on Layer 2 CoS, Layer 3 DSCP, IP precedence, and ACL entries within the same class map. This satisfies the stem's requirement for accurate classification and marking statements, since classification must identify traffic before marking policies apply.

The correct interpretation of the `show mpls interface` output is that both GigabitEthernet0/0 and GigabitEthernet0/1 have MPLS enabled and fully operational. The presence of 'IP: Yes' for each interface indicates that IPv4 label switching is active, while 'Operational: Yes' confirms that the MPLS data plane is ready to forward labeled packets. Therefore, MPLS is not only configured but also functioning on these two interfaces.

vSmart is the control plane controller that uses the Overlay Management Protocol (OMP) to distribute routing, policy, and security information to WAN edge devices. It maintains a centralized view of the overlay and ensures consistent policy enforcement. It does not handle device authentication; that is vBond's role. vSmart is essential for dynamic path selection and policy application across the SD-WAN fabric.

IP Source Guard relies on the DHCP snooping binding table to validate IP-to-MAC bindings. Even with static entries, DHCP snooping must be enabled on the VLAN to maintain the binding table and allow IP Source Guard to function. Without it, the switch cannot validate traffic and may drop packets, causing the server to lose connectivity.

DAI validates ARP packets by looking up the source MAC and IP in the DHCP snooping binding table, which is populated only by DHCP-assigned addresses. Because these hosts use static IPs, no binding entry exists for them. Consequently, DAI will consider their ARP packets invalid and drop them unless an ARP ACL explicitly permits their IP-to-MAC mapping.

vManage is the management plane component, offering a single dashboard for configuration templates, monitoring, and troubleshooting across the whole SD-WAN fabric. This satisfies the requirement for centralised operational visibility and control over all overlay devices.

Cisco DNA Center's Intent API uses the base path '/dna/intent/api/v1/'. The endpoint '/network-device' returns a list of all network devices. A GET request is used to retrieve data. This is the correct method and URL for fetching device inventory. Authentication is required via a token, but the method and path are correct.

The vSmart controller is the SD-WAN control-plane component that builds DTLS/TLS control connections with each vEdge/cEdge and distributes OMP routes, TLOCs, and centralized policy. In this branch scenario, the edge device registers to vSmart, which pushes the routing and policy information needed for the single-transport overlay, making it the component that owns control-plane distribution.

The ip sla schedule command activates a defined IP SLA operation and specifies when it begins and how long it remains active. Without scheduling, the operation stays pending and generates no probes, so no latency, jitter, or reachability statistics are collected.

VRFs provide logical separation at Layer 3 by maintaining independent routing and forwarding tables per customer on shared hardware. This satisfies the stem's path isolation requirement, letting overlapping address space coexist without leakage between tenants across the same physical service provider infrastructure.

MACsec, defined in IEEE 802.1AE, provides hop-by-hop encryption and integrity checking at Layer 2 using GCM-AES. Enabling MACsec on the interfaces is what actually secures the wire between access and distribution. MKA alone negotiates keys but does not encrypt frames, so MACsec must be configured to satisfy the confidentiality and integrity requirement.

LLQ combines a strict-priority queue with a guaranteed bandwidth allocation, so voice packets are serviced first and never dropped during congestion while their reserved bandwidth is protected. CBWFQ alone offers no strict priority, so latency-sensitive voice could still be delayed.

EIGRP Hello packets use the unreliable RTP path, so they carry no sequence number and are never acknowledged. This satisfies the stem's requirement for a true statement about packet types: neighbours detect each other and maintain adjacency through periodic, unacknowledged multicasts rather than reliable delivery.

This is correct because OSPF hello and dead intervals are configurable per interface, and once configured with 5 and 20 seconds, the router will use those exact values for sending hello packets and for declaring a neighbor unreachable. The dead interval of 20 seconds is four times the hello interval, maintaining the recommended ratio for OSPF stability and fast convergence. This configuration is valid and commonly used to tune OSPF convergence times on point-to-point links.

The VNI is a 24-bit identifier that segments the VXLAN overlay. Each VNI represents a Layer 2 or Layer 3 segment. It is used to identify the tenant or subnet. Without VNIs, there is no separation of traffic. In SD-Access, VNIs are mapped to VRFs and subnets. They are required to differentiate traffic in the overlay. Therefore, VNI is a required component.

This command enables the persistence of ifIndex values across router reloads and interface reconfigurations. Without it, Cisco IOS assigns interface indices dynamically based on the order in which hardware and subinterfaces are discovered at boot time, so a reload or adding/removing interfaces can shift the indices. By writing the current ifIndex mapping to persistent storage, the command ensures the NMS continues to associate interface statistics with the correct interface.

Every OSPF router originates a Type 1 Router LSA describing its own interfaces, neighbours and link costs, flooded within its area only. This satisfies the requirement that each router advertises its local topology, forming the basis of the area's shortest-path tree.

LLQ (Low Latency Queuing) combines a strict-priority queue with CBWFQ: the priority queue is serviced first on every scheduling cycle, before any CBWFQ class queues, so voice is dequeued with minimal and deterministic delay. The priority queue can be policed to a configured rate to prevent a flood of priority traffic from starving the non-priority classes, but within the committed rate voice effectively experiences 'express lane' treatment. This strict-priority scheduling is exactly what makes LLQ the standard QoS queueing strategy for real-time voice traffic in an enterprise.

The management interface on a Cisco WLC is used for out-of-band management, including GUI, CLI, and RADIUS communication. It is typically assigned an IP address on the management VLAN and is essential for controller reachability. It is the primary interface for administrative access.

VRF-Lite isolates routing by binding interfaces to a VRF and running an independent routing process per VRF. Without a routing instance inside the VRF, the router has no routes for that VRF, and without interface binding, traffic uses the global table. This combination provides the required isolation on a single device.

In the multicast routing table, the entry for group 239.4.4.4 shows non-zero packet and byte counters, which indicate that the router has actively forwarded or received multicast packets for this group. These counters increment as traffic traverses the (S,G) or (*,G) path, confirming live multicast flow. In contrast, the other group's entry remains at zero, so this is the only active group.

vSmart is the control plane component that distributes policies and reachability information to all SD-WAN devices. It uses OMP to share routing and policy data, enabling application-aware routing and centralized policy enforcement. The branch devices receive their forwarding policies and route information from vSmart, making it the correct answer.

An inform is a confirmed-class notification: the receiving manager must reply with a Response PDU, letting the agent retransmit if none arrives. This satisfies the stem's acknowledgement requirement, unlike an unacknowledged trap, which is fire-and-forget with no confirmation returned to the sender.

:rollback-on-error is a NETCONF capability that ensures if any part of a configuration transaction fails, the entire transaction is rolled back to the previous state. This directly supports the requirement for atomicity and automatic rollback. It works in conjunction with the candidate datastore. Therefore, verifying this capability is necessary to guarantee that errors do not leave the device in a partially configured state.

IGMP is the end-system to router protocol that lets hosts on a directly connected subnet announce their interest in a specific multicast group, which is exactly what an IPTV receiver must do to request a channel. Routers send general queries and process membership reports to maintain an active group list on each interface. IGMPv3 further supports source-specific joins (S,G), enabling explicit control over which IPTV streams are received. Without IGMP, the first-hop router would have no way to know that a host wants multicast traffic.

CoPP uses a modular QoS CLI structure in which class maps match traffic destined to the control plane. Matching combines the control-plane keyword with ACLs, protocol keywords, or NBAR to identify specific flows such as SSH. The matched traffic is then referenced by a policy map that applies a policer, which is attached to the control plane with the service-policy command.

Ansible loads a role's logic from tasks/main.yml, so a role lacking that directory and file has no tasks to execute and cannot function. This satisfies the statement's requirement, though other directories such as handlers, vars and templates remain optional.

A priority queue, implemented via LLQ (Low Latency Queuing) within the CBWFQ shaper, ensures that DSCP EF voice packets are dequeued ahead of all other classes before the shaped output is released. This guarantees that voice traffic experiences low latency and jitter, and critically, that voice packets are not tail-dropped when the shaper's buffer is temporarily congested due to bursts. The priority queue's strict scheduling protects real-time traffic from the queue-full condition that causes drops in other classes.

The fabric control-plane node runs LISP as the control plane for SD-Access, maintaining the endpoint ID-to-RLOC mapping database. Edge nodes register locally learned endpoints with it and query it to resolve remote endpoint locations before building VXLAN tunnels. This centralized mapping service enables same-virtual-network communication across edge nodes while keeping different virtual networks isolated through separate LISP instance IDs.

Only the successor is installed in the routing table; the other path is not used unless the successor fails and queries are sent.

The NVE interface must be configured with a source-interface (typically a loopback) and the VNI must be associated with the correct VLAN. Without this mapping, VXLAN encapsulation or decapsulation fails, preventing communication between hosts on different VTEPs. This is a common misconfiguration that directly causes the described symptom, making this the correct action to resolve the issue.

In a StackWise-480 deployment, the standby switch is ready to take over if the active switch fails. The stack retains its configuration and forwarding state, and the standby becomes active with minimal disruption. This is the designed behavior for high availability, ensuring that network services continue without a full stack reload.

A crypto ACL (also called an encryption ACL) defines the interesting traffic that should be protected by IPsec. It is referenced in the crypto map. Permitting traffic from 10.1.1.0/24 to 10.2.2.0/24 ensures that only this traffic is encrypted. Other traffic falls through the implicit deny and is sent unencrypted, as desired. This is the standard method to specify VPN traffic.

ARP rate limiting or policing limits the number of ARP packets processed by the switch's CPU, preventing excessive ARP traffic from overwhelming the control plane. This directly reduces the load on the ARP Input process. It is an effective mitigation for high CPU caused by ARP storms or ARP-based attacks. Configuring this on interfaces facing untrusted hosts can protect the switch.

Without NAT hairpinning, the router treats a packet from an inside host to the inside server's public IP as inside-to-inside traffic. By default, Cisco IOS applies NAT only to packets crossing a NAT boundary between inside and outside interfaces, so the destination translation is never consulted. Consequently, the public IP is not translated to the private server address and the packet fails. To enable this, you must explicitly configure hairpinning, for example with 'ip nat enable route-map' on the involved interfaces.

Correct because if the return traffic does not pass through the same NAT router, the router will not create an inbound translation entry, and the packet will not be translated back to the private IP.

RadSec (RADIUS over TLS) encrypts RADIUS packets using TLS, providing secure communication between the WLC and the RADIUS server. This protects credentials and attributes from eavesdropping. It is the recommended method for securing RADIUS traffic in modern deployments.

The output explicitly states 'SXP Node enabled' and lists an SXP connection to 10.1.1.1:64999, which is the well-known TCP port for SXP. This indicates the switch actively exchanges SGT-to-IP bindings with that peer, using SXP to propagate Cisco TrustSec security group tags to devices that don't support inline tagging.

DMVPN (Dynamic Multipoint VPN) allows spoke-to-spoke tunnels to be established on demand, enabling direct communication between branch sites without routing traffic through the hub. It uses mGRE (multipoint GRE) and NHRP (Next Hop Resolution Protocol) to dynamically discover and build tunnels. This matches the requirement for dynamic multipoint VPN with encryption, typically provided by IPsec.

VXLAN provides the Layer 2 overlay that carries endpoint traffic across the SD-Access underlay, encapsulating original frames in UDP. This satisfies the design requirement for a data plane encapsulation, separating the virtual overlay from the physical routed fabric.

A leaf-spine design connects every leaf switch to every spine switch, creating a full-mesh fabric at the spine layer while keeping each leaf's uplinks identical. Every server-to-server flow takes at most two hops, and with ECMP (Equal-Cost Multipathing), traffic is spread across all spines, avoiding oversubscription and providing predictable, low latency. Scaling is horizontal — adding another spine increases bandwidth and path options without rewiring existing leaves.

The vBond orchestrator is the mandatory initial entry point in the SD-WAN discovery process: each branch router must have a configured vBond IP or resolvable vBond hostname to initiate the DTLS control-plane session. vBond authenticates the vEdge, verifies its identity, and then returns the IP addresses of vManage and vSmart for further configuration. Without this bootstrap value, the router cannot begin the fabric handshake, which precisely explains the symptoms in the scenario.

The ingress Cisco Catalyst switch (or wireless controller) is responsible for assigning SGTs to packets based on the classification policy received from ISE. It inserts the SGT into the Cisco Metadata (CMD) field of the packet or uses inline tagging. This enables enforcement throughout the network without relying on IP addresses. Thus, the switch is the component that assigns SGTs at the ingress point.

The fabric control plane node runs LISP and maintains the mapping of endpoint EIDs to RLOCs. When a fabric site is connected via a transit network, control plane nodes in each site exchange LISP map-register and map-notify messages so that endpoints in the same VN are reachable across sites while different VNs stay isolated by their respective VRFs and LISP instance IDs.

This configuration enables NAT overload (PAT) by translating all internal addresses matching the access list to the outside interface's IP address. The overload keyword allows multiple hosts to share the same public IP. Marking interfaces as inside and outside is essential for NAT to function correctly. This meets the requirements.

This is correct. The switch, acting as the authenticator, first sends EAPOL-Request/Identity frames and waits for the client's EAPOL response. If the client is not 802.1X-capable or has no supplicant enabled, it will not respond; after the EAPOL timeout expires, the switch falls back to MAB. MAB then performs a RADIUS authentication using the MAC address as both username and password, allowing legacy devices such as printers or IP phones to authenticate without a supplicant.

DSCP (Differentiated Services Code Point) is the 6-bit field in the ToS byte of the IP header, making it a true Layer 3 marking that remains intact as packets traverse routers. It is standardized by the IETF and supports up to 64 codepoints, enabling scalable QoS policies like EF (Expedited Forwarding) and AF (Assured Forwarding). Because it is carried in the IP header itself, DSCP is preserved across heterogeneous network devices and is the preferred marking for end-to-end QoS in enterprise and service provider networks.

This configuration creates a standard ACL that permits the 10.10.10.0/24 subnet and applies it inbound to the VTY lines with access-class. This restricts SSH and Telnet access to only that subnet, meeting the requirement. The implicit deny at the end of the ACL blocks all other sources.

ESP provides confidentiality through encryption and can also provide authentication and integrity for the payload. It is the standard choice for VPNs requiring encryption. ESP can operate in transport or tunnel mode; in tunnel mode, it encrypts the entire original IP packet. This meets the requirement for both confidentiality and integrity of the data payload.

Because the class-map is configured with 'match-all', every match statement must evaluate true for a packet to be classified into that class. QoS class-maps default to 'match-all' unless 'match-any' is explicitly specified; if the engineer configured multiple match conditions such as 'match access-group' and 'match protocol' and only one of those conditions is satisfied, the packet will not be placed in this user-defined class. As a result, the intended QoS policy (such as marking, policing, or queuing) will not apply to that traffic, and the packet falls through to the default class. Changing the class-map to 'match-any' allows the traffic to match when any one of the conditions is true.

BSR is a standards-based mechanism for dynamic RP discovery. It uses candidate RPs and a Bootstrap Router to distribute RP information to all routers in the PIM domain. Routers receive BSR messages and automatically learn the RP mappings. This is a valid method for dynamic RP discovery, making BSR correct.

This is correct because the output explicitly displays '1 interface resets' under the interface counters. In Cisco IOS, the 'interface resets' counter increments each time the interface is reset, typically due to a line protocol drop, a manual admin down/up toggle, or a media renegotiation. The value of '1' indicates exactly one reset event has occurred since the last time the 'clear counters' command was issued on this interface. This is a direct, factual reading of the counter, and interpreting it as 'one reset since the last counter clear' is the most accurate and literal interpretation of the given output.

On a non-broadcast (NBMA) OSPF network type, the link is treated as a multi-access segment, so after the neighbor 192.168.1.2 is manually configured, OSPF forms a full adjacency and performs a DR/BDR election. The router with the highest interface priority (then highest router ID) becomes DR, and election occurs only among routers with priority greater than 0. This is correct because non-broadcast network type requires unicast neighbor configuration and still has multi-access semantics.

This is the most likely cause. The switch is learning the same MAC address on two different ports, which indicates the device is either connected to both ports (e.g., via a loop or a misconfigured NIC teaming) or there is a loop in the network. The switch detects the flapping and generates the syslog message to alert the administrator.

Cisco TrustSec supports SGT propagation through Layer 2 trunks using either Cisco Metadata (CMD) or inline tagging (also known as SGT Exchange Protocol or SXP for Layer 3). Inline tagging embeds the SGT in the Ethernet frame, allowing switches to enforce policies based on the tag without needing to look up the source identity.

EAP-TLS is a certificate-based mutual authentication method: the server presents a certificate and the client must also present a valid client certificate. Since the Windows clients have not been issued client certificates, the client cannot complete the TLS handshake, so authentication fails despite the server being configured for EAP-TLS. This is the root cause described in the scenario.

The show interfaces GigabitEthernet0/1 command displays detailed information about the specified interface, including the configured and operational duplex mode. This is the correct command to verify duplex settings, as it shows both the hardware and configured duplex, and can indicate mismatches.

Application-aware routing policy is created on the vSmart controller and distributed to vEdge or cEdge devices. It defines SLA classes with latency, jitter, and loss thresholds, and can specify a preferred transport such as MPLS. When the SLA is violated, the policy allows failover to the internet transport, exactly matching the requirement to prefer MPLS and fall back on high latency.

Cisco ISE authenticates endpoints using 802.1X, MAC authentication bypass, or web authentication, and returns the VLAN and VRF (or SGT) assignment to the fabric edge node. This is the identity services function that enforces policy before forwarding.

The 802.1Q tag inserts a 12-bit VLAN Identifier field, allowing 4094 usable VLANs per trunk. This directly satisfies the question's requirement by confirming the tag's defined structure, distinguishing it from ISL's 15-bit field and enabling standard-based multi-vendor trunking.

Zone-based firewall uses class-maps to identify traffic and policy-maps to define actions. The policy-map is applied to a zone pair (INSIDE to OUTSIDE) with the service-policy command, so only HTTP is permitted while other traffic is dropped by default.

Spine switches form the fabric backbone.

This access list defines the inside local addresses that are eligible for NAT translation. It permits the entire 192.168.1.0/24 subnet. The NAT command references this list to identify which traffic should be translated. Without this access list, the NAT configuration would not know which addresses to translate. Therefore, it is a required command.

In Cisco SD-WAN, VPN 0 is the dedicated transport VPN that carries underlay connectivity and control plane traffic. The two interfaces are placed in this VPN so they can connect to the WAN edge and establish secure tunnels (DTLS/TLS) with the vSmart controller; they are not used for end-user or customer traffic. This placement also allows vBond to orchestrate the overlay, and the interfaces are often physical ports or subinterfaces that provide underlay transport.