ENCOR 350-401 (350-401) — Questions 226–300

The 'priority queue overflow' log message indicates that the priority queue itself is dropping packets due to exceeding its configured or default policer rate. On Cisco ASR 1000 series routers, a priority class without an explicit 'police' command still has a default policer that limits the priority queue to a percentage of the interface bandwidth (often 33% by default). When voice traffic exceeds this implicit rate, packets are dropped even if the queue depth is not full, because the policer enforces a strict rate limit.

CoS 0 is typically best effort, CoS 3 is voice signaling, CoS 4 is video conferencing, CoS 5 is voice bearer, CoS 6 is internetwork control (e.g., routing protocols).

In a typical service chain, traffic flows from the ingress router through firewall, load balancer, WAN optimizer, and finally to the egress router.

Correct matches: Ansible is agentless and uses SSH/YAML; Puppet uses client-server with DSL; Chef uses server and Ruby DSL; SaltStack uses master-minion and can be agentless. Common confusions involve mixing agentless and agent-based models.

IntServ uses RSVP for per-flow signaling, DiffServ uses DSCP markings for per-hop behavior, Best Effort provides no guarantees, IntServ is not scalable for large networks, DiffServ offers classification and policing at the edge.

src-dst-ip uses source and destination IP, src-dst-mac uses MAC addresses, src-dst-port uses TCP/UDP ports.

Hyper-V enforces a specific range for static MAC addresses assigned to virtual machines. The default allowed range is 00-15-5D-XX-XX-XX, derived from the Microsoft Organizationally Unique Identifier (OUI). If the engineer configured a MAC address outside this range (e.g., starting with a different OUI), Hyper-V will not allow the VM to use it, effectively breaking network communication even though the address is not duplicated on the network.

This question tests understanding of IPv6 transition mechanisms, specifically NAT64 and NPTv6, including their differences and use cases.

For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

The ios_config module first connects to the device, retrieves the running config, compares it with the desired config, applies only the necessary changes, and then saves the config if specified, ensuring idempotency.

The INIT state in OSPF indicates that a router has received a Hello packet from its neighbor but the neighbor has not yet seen its own Router ID in the received Hello. A mismatched Hello interval causes the routers to send Hellos at different rates, so one router may not receive a Hello within the expected Dead interval, preventing the neighbor from seeing its Router ID in the received Hello and thus stalling the adjacency in INIT.

OSPF authentication configuration requires two components: an area-level authentication type (configured via `area 0 authentication message-digest`) and an interface-level authentication mode (configured via `ip ospf authentication message-digest`). The interface command tells the OSPF process to actually use the key defined with `ip ospf message-digest-key`. Without it, the interface defaults to no authentication, even though the area is configured for authentication.

Network automation eliminates human error during repetitive configuration tasks. By using tools like Ansible, Python scripts, or NETCONF/YANG models, configurations are applied consistently without typos or missed commands, which are common in manual CLI entry. This directly reduces the risk of syntax errors, missing parameters, or inconsistent settings that can lead to network outages.

AS_PATH is well-known mandatory; LOCAL_PREF is well-known discretionary; COMMUNITY is optional transitive; MULTI_EXIT_DISC is optional non-transitive; ORIGIN is well-known mandatory.

First, enter global config mode. Then create the IP SLA operation with type icmp-echo, set the target address and optional parameters like frequency, schedule the operation, and finally verify reachability using show commands.

The correct order begins with defining the flow record, then the flow exporter, then the flow monitor, then applying it to an interface, and finally verifying with show commands.

The output shows that the CoPP-POLICY policy map is applied to the control plane in the input direction. For the MGMT-CLASS class, the policer has a CIR of 32000 bps, and the counters show 15 packets exceeded and 5 packets violated, both with a drop action. This confirms that some management traffic is being dropped because it exceeds the configured rate, making option A correct.

OPEN establishes a BGP session; UPDATE advertises or withdraws routes; NOTIFICATION indicates an error; KEEPALIVE maintains the session; ROUTE-REFRESH requests readvertisement of routes.

Intent APIs: inventory retrieves device details; topology provides network maps; issues reports network problems; events tracks changes and alerts.

start-time defines when the operation begins; frequency sets the interval between probes; life sets the total duration; ageout removes the operation after inactivity; recurring repeats the schedule daily.

Push adds a new label to the stack, pop removes the top label, and swap replaces the top label with a new one.

In DMVPN Phase 1, the spoke first establishes an mGRE tunnel to the hub using NHRP registration, then the hub learns the spoke's NBMA address, and finally the spoke can route traffic through the hub. The correct order is: configure mGRE tunnel interface on spoke, configure NHRP with hub as NHS, spoke registers its NBMA address via NHRP, hub adds spoke to its NHRP database, and spoke sends traffic through hub.

ZTP starts with the device contacting the DHCP server for an IP address, then resolving the vManage hostname via DNS, establishing a DTLS connection to vManage, downloading the full configuration, and finally applying the configuration to become operational.

IBNS 2.0 uses a policy map that first triggers 802.1X, then if that fails, concurrently tries MAB and web authentication, evaluates the first successful method, and finally applies the corresponding authorization result.

Root port is the best path to the root bridge; Designated port is the best path for a segment; Alternate port provides an alternative path to the root; Backup port provides a redundant path to the same segment.

SNMPv1 and v2c use community strings for authentication, while SNMPv3 provides encryption, authentication, and message integrity.

RESTCONF is designed to use standard HTTP methods (GET, POST, PUT, DELETE, PATCH) for CRUD operations on YANG-defined data, and it supports both JSON and XML encoding formats. This aligns with its goal of providing a simpler, web-friendly interface compared to NETCONF.

The correct order for activating STP root guard and loop guard begins with entering interface configuration mode (A), then configuring root guard with 'spanning-tree guard root' (B), followed by loop guard with 'spanning-tree guard loop' (C). After configuration, verification of port role and protection status (D) ensures the guards are active. Step E (port moves to root-inconsistent state if superior BPDU received) is not an activation step but a reactive event that occurs when root guard triggers; it is placed last as the expected outcome.

This question tests understanding of DHCP relay operation, including the use of ip helper-address, UDP port forwarding, and configuration requirements.

LACP is an IEEE standard (802.3ad) that allows dynamic formation of EtherChannels. It uses LACPDUs to negotiate parameters, supports up to 16 links (8 active, 8 standby), and can detect mismatched parameters like speed or duplex. The 'active' mode initiates negotiation, while 'passive' waits.

Design creates network profiles and site hierarchy, Policy defines SGTs and access contracts, Provision deploys configurations to devices, Assurance monitors network health, and Automation runs workflows like PnP and SWIM.

T1 runs at 1.544 Mbps, E1 at 2.048 Mbps, DS3 at 44.736 Mbps, and OC-3 at 155.52 Mbps. T3 is 44.736 Mbps (same as DS3).

The Cisco Catalyst 9300 switch supports a maximum of 34 SPAN sessions. This includes local SPAN, RSPAN, and ERSPAN sessions combined, with the switch allocating internal resources to support up to 34 simultaneous monitoring sessions.

When a RADIUS server is unreachable, the device first tries the primary RADIUS server, then any backup RADIUS servers. If all RADIUS servers fail, the device falls back to the local database for authentication. This ensures redundancy.

Root port is the best path to the root bridge; Designated port is the best path for a segment; Alternate port provides an alternative path to the root bridge; Backup port provides a backup path to a shared segment.

The default OSPF hello interval on an Ethernet (broadcast multi-access) link is 10 seconds, as defined in RFC 2328. This interval determines how often a router sends Hello packets to discover and maintain neighbor relationships. On non-broadcast multi-access (NBMA) networks, the default is 30 seconds.

OMP uses attributes like origin, site-id, color, and preference to influence route selection and TLOC reachability.

The correct order ensures that the spoke router first enters EIGRP configuration, then configures the stub feature, optionally restricts stub types, and finally applies the configuration. The hub router does not need stub configuration.

The collector initiates the connection, authenticates, subscribes to specific YANG paths, receives streaming updates, and then processes the data.

Troubleshooting begins with checking physical layer, then verifying protocol negotiation, inspecting bundle state, checking load balancing, and finally reviewing logs.

RADIUS attribute numbers are standardized: User-Name is 1, NAS-IP-Address is 4, Service-Type is 6, Framed-IP-Address is 8, and NAS-Port is 5.

In 802.1X, the supplicant (client) initiates the session by sending an EAPOL-Start, or the authenticator (switch) can send an EAP-Request/Identity to prompt the client. The RADIUS server is the authentication server that validates credentials and sends an EAP-Success or EAP-Failure. The authenticator does not perform the actual authentication; it only relays EAP frames.

Option 43 provides vendor-specific info; Option 60 identifies vendor class; Option 82 is relay agent information.

Ansible Tower job template execution starts with launching the job template; then, Tower provisions an isolated execution environment; next, it checks out the project from the source control; after that, it runs the playbook against the specified inventory; finally, it collects and displays job results and logs.

The PPDIOO network lifecycle consists of six phases: Prepare, Plan, Design, Implement, Operate, and Optimize. The correct sequence from first to last is: Prepare, Plan, Design, Implement, Operate, Optimize.

Manager is the NMS; agent runs on the device; MIB is the database; OID identifies a specific variable.

Weight (highest) is checked first, then LOCAL_PREF (highest), then locally originated routes, then AS_PATH length (shortest), then ORIGIN (IGP > EGP > incomplete).

JSON is lightweight and widely used in REST APIs, XML is verbose and used in NETCONF, YAML is human-readable for configuration files, and Protobuf is efficient for high-performance systems.

VNFs replace physical appliances; common examples include virtual routers, firewalls, and load balancers.

The configuration begins with enabling SR-IOV in the BIOS, then creating virtual functions, assigning them to the VM, and finally installing drivers inside the VM.

LLQ is serviced before any CBWFQ queues to ensure low-latency traffic. Within CBWFQ, queues are serviced in a weighted round-robin fashion based on bandwidth allocation. The default queue is serviced last.

Ingress traffic is monitored with the 'monitor session source interface x/x rx' keyword; egress with 'tx'; both directions with 'both'.

The exhibit shows an access control list (ACL) applied outbound on GigabitEthernet0/0. The ACL permits TCP traffic from source 192.168.1.0/24 to any destination with a destination port of 80 (HTTP) or 443 (HTTPS). Therefore, only HTTP and HTTPS traffic from the 192.168.1.0/24 network is permitted outbound.