ENCOR 350-401 (350-401) — Questions 226–300

The Protocol column in the output explicitly reads LACP, which stands for Link Aggregation Control Protocol, the IEEE 802.3ad standard for dynamically negotiating EtherChannels. This confirms the channel is formed using LACP rather than static configuration (mode 'on') or Cisco's proprietary PAgP. Additionally, LACP is the only protocol among these that supports the standby state (flag 'H'), reinforcing that this output is from an LACP-based EtherChannel.

EIGRP computes its composite metric using the minimum bandwidth along the path and the cumulative delay; lower bandwidth and higher delay both increase the metric value. Since Gi0/1's interface statistics show a less favorable combination of bandwidth and delay compared with Gi0/0, the same prefix learned via Gi0/1 would receive a numerically higher metric. This makes Gi0/1 the less preferred path for that prefix under equal-cost conditions.

An 'invalid-value' error-tag means the server rejected a data value in the payload, usually because it violates the YANG leaf's type, length, or pattern constraints, or because the leaf is placed under the wrong namespace. Aligning the JSON structure and value with the model definition resolves the rejection. The URI and HTTP method are already correct in the scenario, so the payload content is the remaining cause.

Each destination in the output has exactly one successor as shown by the single 'via' entry on the first line of each topology entry. A feasible successor would require an alternate next-hop route with RD < FD, but here the RD equals the FD for every route, making the feasibility condition false. Therefore, exactly one successor and zero feasible successors is the correct interpretation of the output.

In Cisco SD-WAN, the OMP route's TLOC attribute is a fixed-size list that supports a maximum of 8 TLOCs. This allows up to 8 distinct paths for load balancing or failover per route. Adding more paths would require multiple OMP routes or policy-based path selection, but the protocol hard-codes the per-route limit.

The Nexus 1000V VEM runs inside the hypervisor and performs local Layer 2 forwarding between virtual machines on the same host, so intra-host traffic never traverses the physical uplink. It also enforces port profiles and VLAN policies pushed from the Virtual Supervisor Module, which matches both stated requirements.

Port 49 is the IANA-assigned well-known port for TACACS+ (Terminal Access Controller Access-Control System Plus). TACACS+ uses TCP port 49 for reliable, connection-oriented transport, ensuring delivery of control messages between the network device and the AAA server. The Cisco implementation of TACACS+ defaults to TCP port 49, making this the correct answer.

A 401 Unauthorized response indicates the server did not receive valid authentication credentials. RESTCONF over HTTPS typically uses HTTP Basic Authentication, which requires a properly formatted Authorization header containing base64-encoded username and password. If the script omits this header or encodes it incorrectly, the device rejects the request with 401 even though the credentials themselves are valid.

The command 'interface vlan 1' is used to create or enter the configuration mode for the switched virtual interface (SVI) associated with VLAN 1. This allows the administrator to assign an IP address to the VLAN interface, enabling management access to the switch. This is the correct command to configure a management IP on VLAN 1.

DNA Center compares the intended QoS configuration against the running configuration on each device. Pre-existing QoS class maps, policy maps or service policies that differ from the template cause provisioning to fail with Compliance Error, so the conflicting configuration must be reconciled first.

The command 'show bgp l2vpn evpn' displays the BGP EVPN table, including Type-2 routes (MAC/IP advertisement routes). If the switch is not receiving Type-2 routes, this command will show an empty table or missing entries for the expected MAC addresses. It is the primary command to verify EVPN route reception and is essential for troubleshooting control-plane learning.

The global command 'ip multicast-routing' is a prerequisite for any multicast forwarding on a Cisco router. Without this command, the router does not build the multicast routing table (mroute) nor run Protocol Independent Multicast (PIM), so even if packets arrive on GigabitEthernet0/0, they are treated as ordinary unicast traffic and no (S,G) or (*,G) entry is created. This is the root cause because all other configuration—interface IP addresses, PIM, and RP knowledge—is irrelevant until multicast routing is enabled.

GET is defined as safe under HTTP semantics, meaning it must not alter server state; it is intended solely for retrieval. This satisfies the stem's requirement for a true statement about REST methods, since safety distinguishes GET from state-changing methods such as POST, PUT, PATCH and DELETE.

Low Latency Queuing combines a strict priority queue for voice with a policer that caps the priority traffic at a configured rate, such as 30 percent of interface bandwidth. This ensures voice is serviced first with minimal delay while preventing the priority class from starving other queues if voice traffic exceeds the limit, exactly matching the design requirement.

Ingress is enabled on the destination port, so Gi1/0/20 still forwards its own incoming traffic while also transmitting the mirrored copy of Gi1/0/1. Without ingress, the port would drop all normal received frames and act purely as a monitor output. This satisfies the stem's question about the port's forwarding behaviour.

Correct because 'start-time now' starts the operation as soon as the command is entered.

Because the router is configured with passive-interface default, every interface is placed in passive mode by default, meaning EIGRP will not send or process updates on them. The 'no passive-interface GigabitEthernet0/0' command explicitly removes that passive designation only for GigabitEthernet0/0, allowing EIGRP to both send and receive updates on that single interface. As a result, EIGRP adjacency and update exchange occur exclusively on Gi0/0, exactly as the correct answer states, while all other interfaces remain passive and do not participate in EIGRP.

The IP SLA statistics show 15 probes sent and 15 failures, all with a return code of 'Timeout'. A 100% loss rate with timeout return codes is conclusive evidence that the target is not responding to the probe traffic, meaning it is unreachable from the source device. This could be due to the target being down, a routing issue, or an ACL dropping the probes, but the operational conclusion is that the target is not reachable.

Inter-area summarisation is configured on area border routers with the **area** *range* command, which consolidates Type 3 summary LSAs for networks within a specified area. This satisfies the stem's requirement for a true OSPF summarisation statement, since ABRs generate inter-area prefixes and can suppress individual component routes.

The output is from the IPv4 VPNv4 BGP table, and both neighbors are configured with the same AS number (65000) as the local router, which classifies them as iBGP peers. The PfxRcd column shows that each neighbor has sent 5 prefixes, meaning they are actively exchanging VPNv4 prefixes with this router. This is the correct interpretation of the 'show bgp vpnv4 unicast all' output.

FlexConnect (formerly Hybrid REAP) lets an AP locally switch client traffic at the edge and can continue to service clients even if the CAPWAP link to the WLC drops, using local authentication and forwarding policies. This 'split-tunnel' or local-switching capability is precisely what enables a remote site to keep working independently when WAN/controller connectivity is unavailable. That's why it's correct.

Cisco StackWise uses a ring topology to connect stack members. This provides redundancy because if one stack cable fails, the ring can still forward traffic in the opposite direction. StackWise-480 and StackWise-1T are common on Catalyst 9000 switches, offering high bandwidth (480 Gbps or 1 Tbps) and efficient use of stack ports. A ring topology is the standard and most efficient for StackWise.

An access port with a voice VLAN configured uses Cisco's multi-VLAN access behavior: untagged frames from the attached PC are placed in the access VLAN, while 802.1Q-tagged frames from the phone are placed in the voice VLAN. Setting the access VLAN to 200 and the voice VLAN to 100 satisfies the requirement that the PC sit in VLAN 200 and the phone in VLAN 100.

Static NAT establishes a persistent one-to-one binding between the inside local address 10.0.0.5 and the inside global address 198.51.100.5. Because this entry is permanent, both outbound traffic from the inside host and inbound traffic to the global address are translated, allowing external hosts to initiate sessions to the internal server. This is the defining characteristic of static NAT: the mapping is fixed regardless of direction.

Correct because when the first physical port is added with a mode that enables LACP, the port-channel interface is dynamically created.

When OSPF redistributes a default route, the default metric-type is 2 (E2), which means the route's metric remains fixed at the ASBR-advertised value (20) and does not include the internal cost of reaching that ASBR. This is why a default route injected via redistribute or default-information originate is normally seen as an E2 route unless metric-type 1 is explicitly selected.

The correct interpretation of the returned data is that GigabitEthernet1 is administratively and operationally ready: the 'enabled' field is explicitly present and set to true, and the 'ipv4' section contains both an 'address' of 192.168.1.1 and a 'netmask' of 255.255.255.0. A netmask of 255.255.255.0 corresponds to a /24 prefix length. Additionally, the 'type' field 'ethernetCsmacd' confirms this is a standard Ethernet interface, so the interface is up and has a valid IPv4 address.

Zone-based firewall uses class maps to identify traffic and policy maps to apply actions such as inspect. To allow HTTP and HTTPS from LAN to Internet, a class map matching those protocols is required, and the policy map must apply the inspect action so that return traffic is permitted for established sessions.

This is correct because a VMFS datastore can be created by concatenating multiple extents, each residing on a different LUN. When a virtual machine's file (VMDK) is stored on such a datastore, I/O operations can be striped or scattered across those physical LUNs. Because separate LUNs often reside on different spindles, RAID groups, or storage tiers, the hypervisor may need to wait for round-trips over multiple paths or controllers, adding per-I/O overhead and increasing latency beyond what a single-extent datastore would incur.

This configuration enables AAA, sets the default login authentication method list to use TACACS+ first and then local as fallback, defines the TACACS+ server, and creates a local username. This ensures that if the TACACS+ server is unreachable, the router will use the local database for authentication.

This is the correct function. When a spoke sends an NHRP Registration Request, the hub records the spoke's NBMA (tunnel source) address and dynamically adds it to the multicast NHRP map for the tunnel interface. The hub then uses this map to replicate broadcast and multicast traffic (e.g., routing protocol hellos) to every registered spoke by sending a separate IPsec-encapsulated copy to each spoke's NBMA address, enabling pseudo-broadcast over the point-to-multipoint DMVPN network.

The `spanning-tree vlan vlan-id root primary` command is a Cisco macro that forces the switch to become the root bridge by automatically setting its bridge priority to 24576, or to 4096 less than the current lowest priority if another switch already has a priority below 24576. This adjusts the priority dynamically without manual calculation, ensuring the intended distribution switch wins the root election. The command also configures the switch to be the primary root for that VLAN, which is exactly the desired outcome.

Correct. Policing is bidirectional; shaping is unidirectional (outbound) because it requires buffering.

VM-FEX in Cisco UCS Manager presents virtual interfaces from the fabric interconnect down to the hypervisor, so virtual machine traffic is treated like traffic from a physical adapter. It is managed directly in UCS Manager and provides the upstream visibility the administrator wants, satisfying both requirements in the scenario.

EIGRP supports MD5 or HMAC-SHA-256 authentication, which must be configured with a matching key on both neighbors. When R1 has authentication enabled, it inspects the EIGRP authentication TLV in every incoming hello packet; R2's hellos lack this TLV because R2 has no authentication configured, so R1 silently discards them. Because R1 never accepts R2's hellos, the two-way neighbor discovery process fails, and no adjacency is ever established.

The distribution layer aggregates access switches and enforces policy, performing inter-VLAN routing, filtering and QoS between access and core. This satisfies the requirement for policy-based connectivity and traffic-flow control, keeping the core free for high-speed transport.

The OSPF configuration in the scenario explicitly sets the hello interval to 20 seconds and the dead interval to 80 seconds, which preserves OSPF's default dead-to-hello ratio of 4:1 (80/20 = 4). Because both neighbors are configured with these same values, the OSPF dead interval timer remains consistent, and adjacency formation occurs normally. This matches the requirement that neighbors must agree on timer values, not that a strict 4:1 ratio is mandated.

NAT overload, or PAT, multiplexes many inside local addresses onto one inside global address by translating source port numbers, keeping each flow distinct. This satisfies the requirement to share a single public IP across multiple internal hosts simultaneously.

Shape average on the egress interface uses a token bucket to constrain the long-term average traffic rate to the CIR while permitting short bursts up to the configured Bc (and optionally Be). Unlike a policer, the shaper queues excess packets so they are transmitted later, which smooths traffic sent toward the provider and prevents the provider's ingress policer from seeing micro-bursts that trigger tail drops. Matching the CIR and burst parameters to the provider contract ensures the shaped output stays within the contracted traffic profile, making this the only option that actively enforces the committed rate while preserving burst absorption.

MP-BGP EVPN is the control plane that distributes MAC and IP reachability information, including VTEP IP addresses, between VXLAN tunnel endpoints. It allows dynamic discovery of remote VTEPs and their associated MAC addresses, eliminating the need for flood-and-learn. This is the standard Cisco SD-Access and data center VXLAN control plane.

Classes in a control-plane policy-map that have no police action applied are not rate-limited, so matching BGP traffic and simply referencing it in the policy-map exempts BGP from CoPP policing. The engineer can then apply 'police' actions to SSH and SNMP classes. This satisfies the requirement that BGP keepalives are never dropped while still rate-limiting other control-plane traffic.

VLAN configuration syntax is not identical across all Cisco IOS versions: older IOS releases traditionally used 'vlan database' mode, while modern IOS-XE and many IOS 15.x train support interface configuration mode with 'vlan <vlan-id>'. If the playbook uses commands like 'vlan <id>' inside interface config or relies on VTP-related syntax that the specific IOS version does not recognize, the switch will return a '% Invalid input' error at the CLI. This failure would occur only on switches running that divergent IOS version, while other switches with compatible syntax execute successfully.

SWIM maintains a golden image per device family and continuously compares running images against it, flagging or remediating non-compliant devices. This satisfies the stem by showing DNA Center's automated compliance enforcement, not merely image storage or manual upload.

The output shows two distinct RP addresses for the same group range, one elected via Auto-RP and one elected via BSR. This occurs when both Auto-RP and BSR are configured, and the router accepts RP information from both protocols. The result is multiple RP mappings for the same multicast group, which can cause inconsistent RPF behavior and forwarding loops if the RPs differ.

In a Modular QoS CLI policy-map, the 'set dscp' action unconditionally rewrites the DSCP field of every packet that matches the class. Because the policy-map is attached with 'service-policy input', this marking occurs as packets enter the interface: voice traffic is set to EF (46), video to AF41 (34), and class-default traffic to 0. This makes the statement correct.

The MED attribute is used to indicate the preferred path into an AS; lower MED is better.

This is the correct cause. DHCP snooping compares the source MAC address in the Ethernet frame header with the 'chaddr' field inside the DHCP packet itself. When the DHCP client inserts a different MAC address in the chaddr field than the actual source MAC of the frame, the switch flags this as a potential spoofing attempt and drops the packet, incrementing the 'MAC address mismatch' counter. This check prevents a client from impersonating another device's MAC address in DHCP requests.

This sequence generates a 2048-bit RSA key, restricts SSH to version 2, disables Telnet by allowing only SSH transport on the VTY lines, and enforces local authentication with a privilege 15 user. All three requirements—SSHv2, no Telnet, and netadmin-only access—are satisfied by this configuration.

If a configuration line includes a value that the device changes automatically (e.g., 'description Configured on 2025-01-01' or an ACL sequence number), the module will see a difference each time and reapply the line. This results in a 'changed' status even when the intent is already met. The engineer should avoid such dynamic values or use templates that account for them.

If the device is configured to use the candidate datastore, changes made via <edit-config> are not active until a <commit> RPC is issued. The RPC would be accepted without error, but the running configuration remains unchanged. This is a common oversight when using NETCONF with candidate datastores. Issuing a <commit> applies the changes.

Modern switching platforms often use a single FIFO or default priority queue for all traffic until multiple egress queues are explicitly configured through QoS profile or class-map-to-queue mappings. If the engineer only attached a policy-map that sets DSCP/CoS but did not map the class to one of the available hardware queues, the video traffic remains in the default queue and receives no dedicated bandwidth or drop protection. Therefore, the root cause is the absence of a multi-queue schedule, not the marking or policy-map direction.

In DORA, a client first sends DHCPDISCOVER to locate servers; after receiving DHCPOFFER, it sends DHCPREQUEST to accept the offered lease. Because the server logged 100 DISCOVERs but only 95 REQUESTs, five clients either received no suitable offer or abandoned the process before accepting. Thus, the count mismatch directly indicates some clients failed to proceed past the offer phase.

Each customer's routes are held in a separate VRF routing table on the PE router, isolating overlapping address space per VPN. This per-VRF separation is the core mechanism that keeps customer traffic distinct across the shared MPLS backbone.

The management interface on a Cisco WLC is used for in-band management. It must be configured with an IP address, subnet mask, and default gateway to allow remote management from a different subnet. This interface is also used for communication with access points, DHCP, and other services. It is typically mapped to a VLAN on the trunk port.

The fabric edge node is the first-hop device that connects wired endpoints to the fabric. It runs the host tracking database and acts as the authenticator for 802.1X, mapping the endpoint to the appropriate virtual network based on the Cisco DNA Center policy. When a user connects, the edge node performs authentication and assigns the endpoint to the correct overlay segment.

PortFast allows a port to transition immediately to the forwarding state when the link comes up, bypassing listening and learning. BPDU Guard disables the port if it receives a BPDU, protecting against accidental loops if a switch is connected. Together, they meet the requirements for fast server connectivity and loop protection.

The VNI is a 24-bit identifier that uniquely identifies a VXLAN segment. It provides isolation for tenants by separating traffic into distinct logical networks. Each VNI maps to a specific Layer 2 or Layer 3 domain, ensuring that traffic from different tenants remains isolated even when using the same underlay.

Cisco DNA Center enforces role-based access control (RBAC). Even with a valid token, if the user account lacks the required permissions for the Intent API, the request will be denied with 403 Forbidden. The team must ensure the user has a role that includes access to the network device inventory, such as SUPER-ADMIN-ROLE or a custom role with appropriate privileges.

The displayed Security Group ACL (SGACL) contains a rule with source SGT 20 and destination SGT 30, and the action for that rule is PERMIT. This explicitly allows traffic from security group 20 to security group 30, making the statement correct. No other rule in the output overrides or denies this match, so the traffic is indeed permitted.