ENCOR 350-401 (350-401) — Questions 301–375

This is correct because VRF route leaking explicitly permits the USER VRF to learn a route to the management SVI in the MGMT VRF without merging the two routing tables. By configuring a static route in VRF USER with the MGMT SVI IP as the next hop, and then enabling route leaking (for example, via import/export route targets or an appropriate leak statement), the switch installs only the necessary prefix into USER's RIB. This allows SSH from USER hosts to reach the MGMT VRF while all other traffic remains isolated, preserving the path-isolation requirement with minimal configuration overhead.

The redirect ACL, also called the pre-auth ACL, is the core mechanism that makes a Cisco WLC captive portal work. Before a client is web-authenticated, this ACL defines which traffic is permitted through, and everything else is redirected to the virtual interface (or portal server). If entries for DNS (UDP/53) and HTTP (TCP/80) toward the captive portal server or the virtual gateway are missing, the client cannot resolve the portal domain or its initial HTTP request is blackholed instead of being redirected. Without those explicit permits, the WLC drops or fails to redirect the client's traffic, so the captive portal never appears in the browser.

The fabric control plane node runs the LISP map-server and map-resolver functions. It maintains the mapping of endpoint IP addresses to fabric edge nodes, enabling communication between endpoints attached to different edge nodes. When an edge node needs to reach an endpoint not locally attached, it queries the control plane node for the location, which returns the RLOC of the correct edge node.

StackWise Virtual combines two switches into a single logical entity. One switch is elected active and handles control plane and management functions, while the other is standby and ready to take over. Both switches actively forward data traffic, providing increased bandwidth and redundancy. This active/standby control plane with active/active data plane is the defining characteristic of StackWise Virtual.

The State/PfxRcd values of 5 and 3 for the two neighbors indicate that the local router has received a total of eight VPNv4 unicast prefixes from them. Because the command is issued under the VPNv4 address family, these prefixes are VPNv4 routes, which carry an 8-byte route distinguisher and are used in MPLS L3VPN to propagate customer prefixes across the provider backbone. The nonzero counts prove active, established sessions and successful VPNv4 route exchange with both peers, so the correct interpretation is that the router is receiving VPNv4 prefixes from both neighbors.

The output for the ICMP class shows a police CIR of 8000 bps, and the conformed counter equals the total packet count while the exceeded/dropped counter is zero. This means every ICMP packet destined to the control plane was measured as within the committed information rate and was marked conform, so the packets were transmitted normally rather than rate-limited further. The correct statement identifies both the configured rate and the observed behavior: rate-limited to 8 kbps, but with no actual drops because traffic never exceeded the conform burst. This is supported by the 'police' configuration and the accumulated conformed/exceeded statistics in the control-plane policy output.

Correct because policing is supported on both input and output directions in Cisco IOS.

The netconf-yang command enables NETCONF over SSH on port 830 and activates the Cisco IOS XE YANG data models. Using the candidate datastore allows a client to stage edits and then apply them with a commit, which provides atomic transaction semantics: either all changes apply or none do. This directly satisfies the standards-based model and atomic commit requirements described.

Token-based authentication conveys credentials as a bearer token inside the HTTP Authorization request header, letting the API validate the caller without server-side session state. This satisfies the stem's requirement for a true REST API security statement.

Correct because CBWFQ allocates bandwidth to each class based on the 'bandwidth' command.

The 'show nve peers' command displays the state of VXLAN tunnel endpoints (VTEPs) and their peer relationships. It shows the IP address of each peer, the VNI, and the state (Up/Down). This directly verifies if VTEPs can communicate over the underlay, which is essential for VXLAN operation.

The correct answer is a Type 1 hypervisor because it runs directly on the physical hardware, giving VNFs direct access to CPU, memory, and NIC queues. This architecture minimizes latency and enables high-performance features like SR-IOV and DPDK, which are critical for SD-WAN edge devices handling real-time traffic. Cisco SD-WAN virtual appliances (vEdge, vSmart) are validated on ESXi and KVM, both Type 1 hypervisors, to guarantee near-native packet forwarding.

To validate client certificates, the ASA must trust the issuing CA. A trustpoint holds the CA certificate and enables the ASA to verify the certificate chain presented by AnyConnect clients. Without this trustpoint, the ASA cannot confirm the client certificate is genuine, so it is the required configuration for certificate-based client authentication.

MACsec uses a secure connectivity association defined by a connectivity association key (CAK) and connectivity association key name (CKN), either pre-shared or negotiated via MKA. Both endpoints must support MACsec and agree on keys before encrypted frames can be exchanged. This matches the requirement to protect all Layer 2 traffic on the uplink between the two Catalyst switches.

Low Latency Queuing (LLQ) is correct because it integrates a strict priority queue (PQ) with CBWFQ. The LLQ scheduler always empties the priority class before servicing any other CBWFQ class, which guarantees that real-time packets like voice are dequeued first and experience minimal, jitter-free delay. To prevent the PQ from starving other classes, LLQ applies a policer to priority-class traffic, dropping or shaping excess packets while still meeting the latency objective for admitted real-time flows.

The translation for 10.0.0.10 to 192.168.1.100 appears in the show ip nat translations output without any protocol or port information, meaning the mapping is a pure IP-to-IP rewrite. That is the signature of a dynamic NAT translation taken from a pool without the overload keyword, not a PAT entry. It is dynamic because the router instantiated it on the first packet from 10.0.0.10 and will remove it after the idle timeout expires, unlike a static entry that is always present.

RESTCONF uses the GET method to retrieve data. The URI path /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet1 correctly targets a specific interface using the YANG model ietf-interfaces. This is the standard way to read configuration data via RESTCONF. The other methods and URIs are either incorrect HTTP verbs or malformed paths.

IGMPv3 introduces source-specific membership (INCLUDE/EXCLUDE) messages, allowing hosts to explicitly request traffic from a particular source (S,G). This is the foundation of SSM, where the recipient signals a join for a specific source and group, and the router can then forward multicast traffic exclusively from that source. Without IGMPv3, SSM cannot function because legacy IGMPv1/v2 reports are group-only and lack source selection.

This is correct because the command uses the 'always' keyword to unconditionally originate a default route into the OSPF domain, and the explicit 'metric 20' and 'metric-type 2' keywords dictate the cost and external type of that route. The resulting LSA is an external type 2 (E2) route with a metric of 20, which will be advertised to all OSPF neighbors. No default route needs to exist in the local routing table for this advertisement to occur.

MSTP maps many VLANs onto a single spanning-tree instance, so a handful of instances can serve hundreds of VLANs. This is the protocol's core efficiency gain over per-VLAN spanning tree, reducing bridge processing and control-plane load.

VTP client mode allows the switch to receive and synchronize VLAN information from VTP servers but prevents it from creating, modifying, or deleting VLANs. This exactly matches the requirement: the switch cannot make VLAN changes but will stay synchronized with the VTP server.

VXLAN uses MAC-in-UDP encapsulation, with the outer UDP destination port typically set to 4789 (IANA-assigned). The VTEP encapsulates the original Layer 2 frame, adds an outer IP header with the source and destination VTEP addresses, and forwards the packet based on the underlay routing table. This allows Layer 2 segments to be stretched over a Layer 3 underlay.

The VRF routing table shows a 'Gateway of last resort is 10.1.1.1' line, which indicates a default route of 0.0.0.0/0 is installed with next hop 10.1.1.1. This S* route means any destination not matching a more specific prefix will be sent to 10.1.1.1. Thus, the correct statement is that the VRF has a default route pointing to 10.1.1.1.

Cisco DNA Center Assurance relies on model-driven streaming telemetry, where devices push operational data continuously rather than waiting for polling intervals. This satisfies the real-time network health monitoring requirement, delivering near-instant visibility into device and client state without the latency inherent in SNMP-based collection cycles.

Prevents trunk negotiation.

The default-router command inside the DHCP pool configuration specifies the default gateway address that clients receive. Since the router's interface on the subnet is 10.1.1.1, this command ensures clients are configured with that address as their gateway, which is essential for proper routing.

An IKEv2 proposal with aes-cbc-256, sha512, and DH group 19 (256-bit ECP) enforces cryptographically strong negotiation parameters. Only peers offering these algorithms can complete IKEv2 SA establishment, satisfying the strong-parameters half of the policy without weakening backward compatibility beyond the stated requirement.

The tunnel interface is up/up, meaning the interface administrative state is up and the line protocol is up. The protocol is GRE/IP, which confirms a Generic Routing Encapsulation tunnel configured over an IP transport network. An operational GRE tunnel only requires the tunnel source/destination to be reachable and the tunnel mode to be set to GRE; the tunnel being up/up independently verifies that it is operational, regardless of traffic flow.

SXP is a Cisco TrustSec protocol that propagates SGT-to-IP mappings to network devices that cannot natively tag packets with SGTs. It allows enforcement of security group ACLs (SGACLs) on devices that lack hardware SGT support by exchanging IP-to-SGT bindings with peer devices. This enables consistent policy enforcement across mixed hardware, which matches the scenario's requirement for propagation to non-SGT-capable devices.

WRED monitors average queue depth and probabilistically drops packets once the minimum threshold is crossed, signalling TCP senders to slow down before the queue fills completely. This proactive congestion avoidance differs from tail drop, which discards only when the queue is already full.

The control plane node runs the LISP map-server and map-resolver functions, maintaining the database that maps endpoint identifiers (EIDs) to routing locators (RLOCs), which are the fabric edge nodes. When a fabric edge needs to reach an endpoint, it queries the control plane node to learn which edge node is authoritative for that endpoint, enabling proper forwarding.

OSPFv2 message-digest authentication uses MD5 to hash the key and packet contents, so the key is never sent in cleartext. Configuring ip ospf authentication message-digest enables cryptographic authentication on the interface, and ip ospf message-digest-key 1 md5 supplies the key material. Neighbors must share the same key ID and key string for the adjacency to form, which satisfies the requirement to protect against spoofed hellos.

CoPP policies are applied to the control plane by attaching the policy-map to the control-plane interface with service-policy input. This filters traffic destined to the route processor while allowing transit traffic to pass untouched, which preserves the BGP and SSH sessions.

DHCP snooping operates at Layer 2, intercepting DHCP messages arriving on untrusted ports and dropping server-sourced offers, ACKs and NAKs that would otherwise reach clients. Configuring it on access switches satisfies the stem's requirement to filter rogue DHCP traffic before it crosses the broadcast domain, which a Layer 3 device could not do at frame level.

This command displays the Control Plane policy-map configuration and the per-class packet statistics, including matched and dropped packets. It directly shows which traffic classes are being matched and how many packets are being dropped, which is exactly what the administrator needs to verify CoPP operation.

The 'show control connections' command displays the state of control plane connections between the vEdge router and vSmart controllers, including uptime, local and remote IPs, and status. This directly helps verify if the control plane is stable, which is crucial for diagnosing intermittent packet loss due to control plane issues.

RADIUS authentication traditionally used UDP 1645, but RFC 2865 reassigned it to UDP 1812, with accounting on 1813. Cisco devices default to 1812 for authentication, making this the standard port for access-request and access-challenge exchanges.

VXLAN encapsulates original Layer 2 Ethernet frames within UDP packets, typically using UDP port 4789. This allows Layer 2 segments to be extended over a Layer 3 underlay network. The encapsulation includes a VXLAN header with the VNI, and the outer IP header enables routing across the underlay. This is the core mechanism of VXLAN.

A successful GET returns the requested representation with 200 OK, confirming the resource was retrieved. This is the standard success code for read operations, distinguishing it from 201, which signals resource creation rather than retrieval.

The virtual link is identified by the router ID of its remote endpoint, and in the displayed output 'ospf 2a54f7' (likely from 'show ip ospf virtual-links'), the destination is 'router 2.2.2.2'. This means 2.2.2.2 is the neighboring ABR that, together with the local router, forms the virtual adjacency across the transit area. Therefore, stating that 2.2.2.2 is the other endpoint is accurate.

Trunk ports carry 802.1Q frames between infrastructure devices, so the switch defaults to trusting the CoS field in the frame header. This design assumes that the upstream switch, router, or voice gateway has already classified and marked the traffic, and preserving that Layer 2 marking prevents frame-by-frame reclassification. If you want to trust DSCP instead of CoS on a trunk, you must explicitly override the default with 'mls qos trust dscp'.

FlexConnect is correct because it separates the control plane (which remains with the WLC) from the data plane (which is switched locally at the AP). This allows client traffic to be forwarded directly to the wired network at each access point, avoiding unnecessary latency and controller bottlenecks, which is ideal for high-bandwidth, high-density indoor environments. Furthermore, FlexConnect supports IEEE 802.11r fast roaming and can perform client-based or AP-based neighbor discovery when connected to a WLC, ensuring seamless and fast handoffs as users move across the office. Its design balances centralized management with localized forwarding, offering both the operational consistency of a controller and the performance of distributed switching.

In multi-socket servers, memory accessed from a remote NUMA node incurs significantly higher latency and consumes inter-socket bandwidth, which can severely degrade throughput for VNF service chains. Pinning all VNFs to the same NUMA node ensures memory allocations are local to the CPU cores executing packet processing, maximizing cache locality and minimizing cross-node traffic. This configuration directly reduces the latency and overhead associated with data plane forwarding between VNFs within a chain.

This configuration sets the port as an access port for data VLAN 10 and enables voice VLAN 200 for tagged voice traffic. The switchport voice vlan command instructs the switch to use 802.1Q tagging for voice frames while data frames remain untagged. This is the standard Cisco configuration for connecting an IP phone with a PC attached, meeting the requirements.

NAT64 performs stateful protocol translation between the IPv6 and IPv4 headers, rewriting addresses and ports so an IPv6-only host can reach an IPv4-only server. This satisfies the stem's requirement that translation works in both directions, unlike NPTv6, which only rewrites prefixes and cannot cross protocol versions.

Correct. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but be marked as not valid.

Correct. In FlexVPN, the hub assigns IP addresses from a pool. If the spoke statically configures an IP address, the hub may not have a route back to that address, causing asymmetric routing or unreachability.

VTP pruning suppresses flooding for a VLAN on a trunk only when the downstream switch reports no active ports in that VLAN, based on VTP advertisements. This matches the stem's constraint about dynamic removal tied to remote switch membership.

IKEv2 requires peer authentication before establishing the IPsec SA. A keyring with pre-shared keys or a PKI trustpoint with certificates provides that authentication. Without it, IKEv2 negotiation fails. This element is mandatory for strong authentication and directly supports the requirement. It is separate from the IPsec transform set, which protects the data plane, so both are needed in the overall configuration.

When a NETCONF session is established over SSH, both the client and server exchange <hello> messages. The server's <hello> contains a <capabilities> element listing all supported YANG models and protocol features. This is the standard mechanism for capability discovery, and the client must parse this message to learn which models are available.

Area 0 already enables MD5 authentication, but the interface itself lacks the enabling command, so no digest is sent. Adding 'ip ospf authentication message-digest' on GigabitEthernet0/0 activates authentication, allowing the configured key 1 to be used.

For VXLAN EVPN to learn remote MAC addresses, the VNI must be mapped to the correct VLAN. If the mapping is missing or incorrect, the switch cannot associate incoming EVPN routes with the local VLAN, preventing MAC learning. This is a common misconfiguration that breaks overlay connectivity.

MED (Multi-Exit Discriminator) is an optional, non-transitive BGP attribute used to influence inbound traffic from a neighboring autonomous system. When comparing multiple paths that share the same neighboring AS, Cisco IOS prefers the path with the lowest MED value, making lower better. MED is the correct answer because it is the only attribute among the listed options where a numerically lower value is explicitly preferred in BGP path selection, and it is typically set to reflect internal IGP metrics or link costs.

EIGRP computes a composite metric from bandwidth, delay, load, and reliability, then selects the path with the lowest metric as the successor to install in the routing table. Any other paths, even if they are feasible successors or simply higher-metric routes, remain in the topology table. Since 26880 is lower than 28160, the route from R2 is not installed, directly illustrating EIGRP's best-path selection mechanism.

Automation eliminates manual mistakes.

AS path prepending artificially extends the AS_PATH attribute, so ISP B sees a longer AS path and deprioritizes that route for inbound traffic, while the /24 remains advertised normally. Setting a higher local preference for routes learned from ISP A only influences routers inside your autonomous system, causing outbound traffic to prefer ISP A regardless of other attributes. This separation of inbound and outbound control is exactly the standard BGP traffic engineering approach.

The interface-level command 'mpls label protocol tdp' takes precedence over any global or routing-protocol-level LDP configuration. On Cisco IOS, interface-specific configuration is applied after global settings and thus overrides them, so the interface uses TDP exclusively for label distribution. Even though 'router ldp' enables LDP globally, the interface's explicit TDP directive forces TDP on that interface. This is the standard precedence behavior for MPLS label protocol selection.

The Fabric Edge node is the ingress point for every endpoint—wired or wireless—into the SD-Access fabric. It terminates VXLAN tunnels from access switches and wireless APs, hosts the anycast gateway for the subnet, and enforces policy via Cisco TrustSec (SGT-based segmentation) and ACLs. All user traffic enters here, making it the correct component for integrating policies and providing connectivity.

A 30% error rate is abnormally high for a healthy wireless link, indicating that frames are frequently corrupted or lost. This pattern is typically associated with co-channel interference from neighboring APs or signal issues such as excessive path loss, multipath, or hidden nodes. The high error rate is a key diagnostic sign, making this the most accurate conclusion.

A static route to 192.168.1.0/24 with administrative distance 1 creates a more trustworthy entry than OSPF's default AD of 110, so the router prefers the static route for that exact prefix. This is the precise, surgical fix: it overrides OSPF only for this subnet while leaving all other OSPF-learned routes untouched, and it does not depend on the metrics of the two equal-cost OSPF paths.

Management traffic matching MGMT-ACL is policed at 32 kbps, and the exceeded and violated counters confirm drops: 15 exceeded packets plus 5 violated packets were discarded rather than transmitted. This satisfies the stem's constraint that control-plane policing actively rate-limits management traffic, proving CoPP enforcement is operational on R1.

The 'show interfaces status' command provides a summary of all interfaces, including their status (connected/notconnect), VLAN, duplex, speed, and type. This is ideal for quickly verifying physical layer connectivity and interface configuration on Cisco switches, as it displays the operational state and speed of each port.

The Client 360 view in Cisco DNA Center Assurance provides a comprehensive, detailed timeline of a specific client's onboarding and connectivity events. It includes granular data on association, authentication, DHCP, and other phases, allowing the administrator to pinpoint delays. This is exactly the tool needed to analyze the onboarding process step by step.