ENCOR 350-401 (350-401) — Questions 376–450

GRE tunnels can carry multicast traffic, and when combined with IPsec, the GRE packets are encrypted. This allows OSPF to form neighbor adjacencies over the tunnel because OSPF uses multicast (224.0.0.5/224.0.0.6). Native IPsec cannot carry multicast, so GRE over IPsec is the standard solution for dynamic routing protocols requiring multicast over a VPN.

Dynamic desirable mode actively transmits DTP frames to initiate trunk negotiation, and it will successfully establish a trunk when the neighbor is configured as trunk (unconditional), desirable (actively negotiates), or auto (passively accepts). Only a neighbor explicitly set to access mode will refuse the DTP messages, leaving the link in access state. Therefore, the interface always attempts to trunk, and the outcome depends entirely on the peer's willingness to participate in negotiation.

vManage is the management plane that stores device configurations and policies. During zero-touch provisioning, the vEdge router obtains its configuration from vManage after being directed by vBond. vManage is essential for pushing the initial configuration and managing the device thereafter.

EVPN uses MP-BGP with the EVPN address family to distribute MAC and IP reachability information among VTEPs. This provides a control plane for VXLAN, enabling features like ARP suppression, optimal forwarding, and multi-homing. The BGP EVPN routes include MAC/IP advertisement routes, IMET routes for multicast, and Ethernet segment routes. This is a fundamental aspect of EVPN-based VXLAN.

SD-Access decouples identity from location by using a VXLAN overlay, so a user keeps the same IP subnet and security group tag whether wired or wireless. This eliminates per-floor VLAN/subnet sprawl and enforces consistent group-based policy through the fabric, which directly matches the stated requirement for unified wired/wireless policy with minimal VLAN provisioning.

RESTCONF GET returns structured JSON or XML over HTTPS, and Python's requests library can call it directly from a script. Saving the responses into a repository gives the team version-controlled, structured backups. This matches the imperative, script-driven preference and avoids CLI parsing, making it the most aligned approach for programmatic configuration retrieval at scale.

These translations are one-to-one and permanent, with no protocol or port fields and no outside address — a signature of manually configured static NAT. Each entry maps a private inside-local address to a public inside-global address, allowing consistent inbound and outbound connectivity for those two hosts. There is no address-pool assignment or timeout behavior, which further distinguishes it from dynamic and PAT translations.

UDP jitter operations in Cisco IP SLA send packets at a defined interval and measure round-trip latency, one-way delay, jitter, and packet loss, with configurable thresholds that trigger alerts or actions. This directly addresses the need to characterize the provider's handling of the committed rate across the WAN.

Routing protocols are essential for network stability, so they should be matched in dedicated class maps and given sufficient policing rates to avoid dropping legitimate updates. This allows CoPP to protect the CPU while preventing disruption to OSPF and BGP adjacencies, which is a key requirement in the scenario.

EIGRP uses a 1-byte field to track hop count, which gives it an absolute ceiling of 255. This limit applies regardless of metric values, so even a route with a very low composite metric becomes unreachable if it traverses more than 255 routers. The value 255 is thus the finite, hard-coded maximum, and any route advertising a hop count beyond that is considered invalid.

Separate class-maps allow granular classification, and the policy-map can apply different police actions per class. Routing classes can be policed generously (or with conform-action transmit and exceed-action transmit for critical control traffic), while SSH and SNMP are rate-limited. This is the standard CoPP design pattern for differentiated control-plane protection.

The DHCP pool is correctly identified as the root cause when the network command defines a subnet that does not match the VLAN interface's primary IP subnet. Cisco IOS selects a DHCP pool by comparing the network statement's subnet with the subnet of the interface that received the client's DHCP request (or the giaddr from a DHCP relay). If there is no matching pool, the server may assign an address from a different, incorrectly configured pool or fail to offer an address entirely, and critically, pool-specific options such as the DNS server are not delivered because they are bound to the pool that is actually selected. The symptom of clients obtaining an IP but no DNS option strongly points to this mismatch.

In model-driven telemetry, a subscription is a required configuration construct that binds the desired YANG data paths (e.g., interfaces, CPU/memory stats) to a destination collector. Even if the gRPC server is operational and the collector is reachable, no telemetry data is streamed until a subscription is created and active on the router. This is the root cause because the symptom is a complete absence of data, not malformed or dropped data.

An anycast gateway uses the same virtual IP and virtual MAC on every leaf that participates in the VLAN, so a host keeps the same default gateway regardless of which leaf it attaches to. This is what enables seamless workload mobility without re-ARPing or changing host configuration when a virtual machine moves between racks.

The script lacks exception handling for authentication or connection failures, which means any Netmiko exception such as AuthenticationException, NetmikoTimeoutException, or ssh_exception.NetmikoTimeoutException will propagate up and crash the script. In real-world environments, network devices may reject credentials, have SSH disabled, or become temporarily unreachable, and without try/except blocks the automation halts immediately. Properly designed scripts should catch these specific exceptions, log meaningful error messages, and optionally implement retry logic to ensure resilience.

The 'adjacent neighbor count' of 2 is equal to the total neighbor count, which in OSPF terminology means every discovered neighbor has reached the full state after completing database exchange. On a multi-access broadcast segment, only the DR and BDR form full adjacencies with all routers, so this equality confirms that R2 has fully synchronized its LSDB with both neighbors and no neighbor is stuck in two-way or exstart state.

This is the correct behavior. The 'parents: interface GigabitEthernet0/1' parameter makes the Ansible ios_config module first enter interface configuration mode; then the commands in 'lines' are applied as subcommands under that interface. The line 'ip address 192.168.1.1 255.255.255.0' assigns the IPv4 address, and 'no shutdown' changes the interface administrative state from admin-down to up, enabling the interface. The module mimics a human CLI session, so both commands are committed to the running configuration exactly as if typed manually.

TACACS+ authorization for EXEC sessions relies on AV pairs returned by the server. The cisco-av-pair shell:priv-lvl attribute tells the router which privilege level the user receives after authentication. Without it, the AAA client defaults to privilege level 1, so the user cannot enter privileged EXEC mode. Supplying the AV pair in the ISE authorization policy resolves the symptom directly.

On a VTEP, the mapping of VLANs to VNIs is configured in the VNI-to-VLAN mapping table. When a frame enters an access port on a VLAN, the VTEP looks up the corresponding VNI and encapsulates the frame with a VXLAN header containing that VNI. This mapping is essential for bridging VLANs across the VXLAN overlay. Thus, this component is responsible for the mapping.

In EIGRP, the passive-interface command does far more than suppress hello packets; it completely disables the protocol on the specified interface for both control and data-plane updates. Specifically, the router will neither send nor receive EIGRP hello packets, which prevents the formation of any neighbor adjacency, and it will also suppress the transmission of all routing updates (unicast or multicast) out that interface. This is why remote sites stop receiving routes: even though the adjacency may have existed before, once passive-interface is applied, the router no longer advertises any learned routes over that link. The command is often used on LAN-facing interfaces to stop unnecessary multicasts, but on a WAN link it effectively isolates the remote site from the EIGRP domain.

The <get-config> RPC requires a <source> element to specify which datastore to retrieve configuration from. The running datastore is commonly used. Without it, the NETCONF server cannot determine which configuration to return, resulting in an error. Adding <source><running/></source> resolves the issue.

The `aaa accounting exec default stop-only group tacacs+` command instructs the router to generate a TACACS+ stop accounting record only when the EXEC session ends. This record contains cumulative data like session duration, input/output bytes, and the reason the session closed, and it is sent to the TACACS+ server at that moment. There is no start record transmitted at session initiation, which matches the 'stop-only' behavior.

RESTCONF indeed uses HTTP methods and supports JSON and XML.

The ingress enforcement device, such as a switch or wireless controller, assigns the SGT to traffic as it enters the network. It can do this statically via port configuration or dynamically based on authentication and authorization from Cisco ISE. The SGT is then carried in the packet, allowing egress devices to enforce SGACLs based on the tag without needing to reclassify the traffic.

CoS 5 combined with DSCP EF (Expedited Forwarding, DSCP 46) is the industry-standard marking for voice bearer traffic in a campus network. This dual marking ensures that voice frames are placed in the strict-priority queue at both Layer 2 and Layer 3, providing the low latency, low jitter, and minimal packet loss that real-time audio requires. The EF PHB (Per-Hop Behavior) is designed to guarantee a configured bandwidth and queue service, while CoS 5 aligns with the Cisco-recommended voice VLAN and switch port trust settings, making this the only correct answer.

NETCONF supports filtering of <get-config> and <get> responses using the <filter> element. The filter can be a subtree filter (matching XML structure) or an XPath filter (using XPath expressions). By specifying a filter, the engineer can limit the response to only the desired configuration, such as interfaces. This is a standard NETCONF capability and is essential for efficient data retrieval.

In a StackWise stack, the standby switch is a hot-standby that continuously synchronizes its configuration and state with the active switch. If the active switch fails, the standby switch quickly becomes the new active switch, minimizing disruption. This is the correct description of the standby switch's role, ensuring high availability and rapid failover.

When QoS is globally enabled, all switchports default to an untrusted state, meaning they do not preserve any priority information carried in incoming frames. Every packet received on such a port is marked with CoS 0 (and correspondingly DSCP 0) before entering the switch fabric, so saying the port is untrusted and marks all packets with CoS 0 accurately describes the default behavior.

Voice VLAN is a Cisco feature that automatically assigns a VLAN to IP phones based on CDP or LLDP discovery. The switch detects the phone and places its voice traffic in the configured voice VLAN, while data traffic from a connected PC remains in the access VLAN. This simplifies deployment and ensures QoS for voice.

Enabling BGP as the host-reachability protocol on the NVE interface causes the leaf to advertise and learn MAC/IP and IMET routes through EVPN, so remote MAC addresses are resolved from the control plane instead of flood-and-learn. The loopback source provides a stable VTEP address reachable across the underlay, which is required for the EVPN peering and for tunnel endpoints to be consistent.

The ACL permits exactly two types of traffic: SSH to destination host 10.1.1.1, matching the ubiquitous TCP/22 ACE, and ICMP echo-reply (type 0), which is the response packet generated when the device answers a ping. The first ACE uses 'host 10.1.1.1' as the destination, and the second ACE explicitly matches that ICMP type. Together, those two permit statements validate this answer as the only fully accurate description of the ACL's effect.

Ansible Vault allows encrypting sensitive data such as passwords. The encrypted file can be decrypted at runtime with a vault password, which can be provided via a file or prompt. This keeps passwords out of plaintext in the playbook and enables secure, non-interactive automation. This is the recommended method for securing credentials in Ansible.

The 'transport input ssh' command on the VTY lines restricts remote CLI access to SSH only, effectively disabling Telnet. Setting 'ip ssh version 2' globally forces the device to use only SSH version 2. Together, these commands meet the requirement to allow only SSHv2 and block Telnet, which is the standard hardening practice for management access.

The Network Health dashboard in Cisco DNA Center Assurance provides an overview of device and link health, including error counters such as CRC errors and interface flaps. It highlights devices with the most issues, allowing administrators to quickly identify problematic areas. This is the appropriate dashboard for finding devices with high error rates.

In a DMVPN phase 3 deployment with EIGRP, the hub's 'ip next-hop-self eigrp' overrides the next hop in advertised routes to the hub's own tunnel address. As a result, spokes receive routing updates that point to the hub for all remote networks, so they never discover the actual tunnel IP of the destination spoke. Without that real next hop, NHRP's shortcut triggering mechanism never fires, and traffic must hair-pin through the hub instead of building a direct spoke-to-spoke tunnel.

This command displays detailed forwarding ASIC resource utilization, including TCAM, packet buffer, and other hardware forwarding resources, on the active switch of a Catalyst 9000 series switch. It is the correct choice for verifying ASIC status and resource usage when troubleshooting hardware forwarding issues, as it provides granular per-ASIC data that can identify resource exhaustion or errors.

The /dataservice/device endpoint in vManage REST API returns a list of all devices managed by vManage, including their system IP, hostname, and status. This is the correct endpoint for retrieving device inventory. It supports filtering and pagination. The engineer can use this to identify devices for further automation tasks.

2 seconds is the correct default hello timer as defined by IEEE 802.1D for classic Spanning Tree Protocol. The root bridge sends a configuration BPDU every 2 seconds, and non-root bridges forward these BPDUs outward to maintain a stable, loop-free topology. This 2-second default is also used in Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP).

Session 2 in the AAA output lists the username 'jdoe' and explicitly reports 'Method: LOCAL', meaning the device authenticated this user using its locally configured user accounts. This is a fundamental fallback or per-user method in AAA, where the network device itself stores credentials instead of querying an external server. Therefore, the correct conclusion is that jdoe was authenticated locally, even if RADIUS was available for other sessions.

Port security defaults to a maximum of one secure MAC address per port, so the sticky command alone does not raise that limit. When the replacement device presents a second MAC, the default maximum is exceeded and the violation mode error-disables the port.

SXP is a transport mechanism that only propagates IP-to-SGT bindings that already exist locally on the speaker device. If the access switch has not been configured with a downloadable SGT from 802.1X (e.g., via Cisco ISE policy and RADIUS dACL attributes) or with static 'ip sgt' mappings, then its SXP table is empty and there is nothing to publish to ISE. The absence of local SGT assignments is the direct cause of no SGTs being sent.

Setting the OSPF priority to 0 on an interface prevents that router from being elected as DR or BDR. The priority value is used in the DR election process; routers with priority 0 are ineligible. This is the correct method to ensure the router does not become DR or BDR while still participating in OSPF on that network.

A dynamic interface on the AireOS WLC is a user-defined VLAN interface that maps a WLAN to a specific VLAN and is commonly placed on a DMZ segment for guest traffic. Assigning the guest WLAN to a dynamic interface isolates guest clients from corporate clients on the management interface and allows traffic to be tunneled to a firewall in the DMZ.

The command 'transport input ssh' under the VTY line configuration restricts incoming connections to SSH only, which is required to enable SSH access. Without it, the router may still allow Telnet or other protocols. This command ensures that only secure shell connections are accepted, aligning with the requirement to manage the router via SSH.

The command 'router ospf 1 vrf CUSTOMER' starts an OSPF process with process ID 1 and associates it with the VRF named CUSTOMER. This is the correct syntax to enable OSPF within a specific VRF on Cisco IOS-XE. Once configured, OSPF will run in the context of that VRF, and routes will be installed in the VRF's routing table.

VRF CUSTOMER-B is correctly associated with subinterface GigabitEthernet0/1.20, as shown in the Interface column of the output. This association is made by applying the command "ip vrf forwarding CUSTOMER-B" on that subinterface, which binds the subinterface's traffic to the CUSTOMER-B VRF routing table. Therefore, this is the correct option.

The ios_vlan module with state: present performs an idempotent operation: if VLAN 100 does not exist in the device's VLAN database, it creates it and assigns the name 'Engineering'. If the VLAN already exists but has a different name, the module updates the name to match the declared state. Because the operation is declarative, Ansible compares the current configuration to the desired configuration and applies only necessary changes.

The '5' in the State/PfxRcd column is the number of Network Layer Reachability Information (NLRI) prefixes that this router received from 10.0.1.5 over the established BGP session. Crucially, when the session is in the Established state, the column shows a numeric prefix count rather than a state keyword such as Active, Idle, or Connect. Thus, the neighbor is up and has successfully exchanged routes.

A trunk port with 802.1Q encapsulation carries multiple VLANs over one physical link, tagging frames with the appropriate VLAN ID. Restricting allowed VLANs to 10, 20, and 30 matches the router's subinterfaces and prevents unnecessary broadcast flooding. This is the standard router-on-a-stick configuration and satisfies the multi-VLAN uplink requirement.

The Assurance feature in Cisco DNA Center provides comprehensive monitoring, health dashboards, and issue detection. It uses telemetry and analytics to show network health, client health, and application health, and it highlights problems that need attention. This is the correct feature for the administrator's requirement.

The police rate alone can cause drops even when the average bit rate is below the configured police rate because CoPP uses a token bucket that only allows short bursts up to the burst size. Once the bucket is empty, every packet that exceeds the sustained rate or even a momentary burst is marked as exceeding and is dropped by the exceed-action. Intermittent drops are the classic symptom of a policer with a low rate or small burst parameters, not a config error.

MAB allows devices that do not support 802.1X to authenticate using their MAC address. When MAB is enabled, the switch sends the device's MAC address to the RADIUS server (ISE) as username and password. If the MAC address is known, the device can be authorized and assigned to a VLAN, such as a guest VLAN. This is the standard method to support non-supplicant devices.

CoPP uses a modular QoS CLI policy attached to the control-plane interface to rate-limit and classify traffic destined to the route processor. It allows the engineer to define class maps for protocols such as IKE, SSH, and SNMP, then apply policing actions so that a flood of tunnel negotiation packets cannot exhaust CPU resources. This directly addresses the hardening goal for the IPsec headend by protecting the control plane from abusive traffic.

In the output of 'show mpls ldp neighbor', the 'Discovery Source' (or 'Discovery sources') field lists the interface through which LDP hello messages were received from the peer. Since the output shows GigabitEthernet0/0 as the discovery source, the neighbor adjacency was formed over that interface, and the LDP session (which uses a TCP connection for label exchange) is consequently established over that interface. This confirms that LDP is operating correctly on GigabitEthernet0/0, which is why this answer is correct.

This sequence enters interface configuration mode, sets the port to access mode, and assigns it to VLAN 20. The 'switchport mode access' command forces the port to operate as an access port, and 'switchport access vlan 20' associates it with VLAN 20. This is the standard method to configure an access port on a Cisco switch.

CoPP class-maps only act on traffic the ACL permits; denied traffic matches no class and falls to the default class, which typically permits it. So other BGP peers are not rate-limited, explaining why their sessions still establish.

The `set dscp 0` command explicitly overwrites the Differentiated Services Code Point bits with binary 000000. DSCP 0, also known as CS0 or default PHB, is the standard best-effort marking applied to normal IP traffic. Because this is an explicit action in a policy-map, it always results in DSCP 0 regardless of any original marking.

This is a Cisco proprietary STP enhancement that accelerates convergence after a direct link failure on a switch port that was in a blocking state. When a root port fails, UplinkFast immediately transitions a designated alternate port to forwarding state without waiting for the normal MAX Age + Forward Delay timers (typically 30-50 seconds). It works by caching a multicast frame from the root to verify the alternate path, but the primary effect is fast failover to a redundant uplink, often within 1-5 seconds. This directly improves convergence time.

NUMA pinning assigns each VM to a specific NUMA node so that all memory allocations stay within that node's local memory, eliminating costly remote memory access over the interconnect. CPU pinning locks a VM's vCPUs to specific physical cores, preventing the hypervisor from migrating them across sockets or cores and removing run-queue and scheduling delays. Combined, these techniques provide deterministic access to dedicated cores and local memory, preserving cache locality and reducing latency to near-bare-metal levels, which is essential for latency-sensitive enterprise applications.

A trunk port carries frames from multiple VLANs and tags each frame with its 802.1Q VLAN ID, except for the native VLAN which remains untagged. Router subinterfaces configured with encapsulation dot1Q can accept these tagged frames, allowing the router to route between VLANs over one physical link. This is the required configuration for router-on-a-stick inter-VLAN routing when a single router interface must handle traffic for many VLANs.

Client 360 provides detailed information about a specific client's connectivity experience, including disconnect reasons, onboarding issues, and RF statistics. By selecting the affected clients, the engineer can see the exact cause of disconnects, such as authentication failures or roaming problems, making it the best tool for root cause analysis.

A GRE tunnel interface can carry unicast, multicast, and broadcast traffic, which allows dynamic routing protocols such as OSPF or EIGRP to form adjacencies and exchange updates. Wrapping the GRE tunnel in IPsec protects the traffic. This combination meets both the routing and multicast requirements that plain IPsec tunnel mode cannot satisfy.

The transform-set with esp-aes 256 and esp-sha256-hmac specifies AES-256 encryption and SHA-256 HMAC for integrity. The set pfs group14 command in the crypto map enables perfect forward secrecy using Diffie-Hellman group 14 (2048-bit). This combination meets both requirements: AES-256 encryption and PFS. The transform-set and crypto map together define the IPsec policy for the tunnel.

The route to 10.3.3.0/24 is an external route redistributed into OSPF. In the routing table, the code 'O E2' explicitly marks this as an OSPF external route of type 2. Type 2 (E2) routes are routes that originated outside the OSPF domain and were redistributed into OSPF, typically from another routing protocol such as EIGRP or BGP. The external cost is carried as configured on the ASBR, and in this case the metric of 20 is the default external cost for redistributed routes, confirming the redistributed origin.

In Cisco NAT, the access list referenced by ip nat inside source list is evaluated against the source addresses of traffic entering the inside interface. Because ACL 100 does not contain an explicit permit statement for 172.16.0.0/16, the implicit deny any at the end prevents those packets from being translated. The router therefore forwards them with their private source IP unchanged, so return traffic from the Internet cannot be routed back to that subnet. A working ping to the gateway does not imply NAT is working; it only confirms Layer 3 reachability.

LISP separates endpoint identity from location, allowing a client to keep its IP address while its location changes. In a campus design, LISP can be used to provide seamless mobility across Layer 3 boundaries by updating the mapping of the endpoint identifier to its new routing locator.