ENCOR 350-401 (350-401) — Questions 451–525

The CLI configuration order follows Cisco IOS-XE syntax: enter telemetry mode, define subscription, set receiver, specify stream, and apply sensor path.

The selection process starts with the client choosing an encoding, setting the Accept header, the server reading it, encoding the response accordingly, and the client parsing the response.

App-aware routing begins with classifying traffic by application, then measuring path performance (loss, latency, jitter), comparing against SLA requirements, selecting the best path, and finally steering traffic over that path.

The output shows that for the SNMP-CLASS, 40 packets exceeded and 10 packets violated the policer, resulting in drops, while the BGP-CLASS had 0 exceeded and 0 violated packets, meaning all BGP traffic conformed to its CIR of 64000 bps. This confirms that SNMP traffic is being dropped due to exceeding its policer rate, while BGP traffic is within its rate.

When a VRF is applied to an interface on a Cisco ASR 1000, the interface's IP address is removed because the VRF changes the routing context. The engineer must reconfigure the IP address under the VRF interface. Without the IP address, the BGP session cannot establish a TCP connection, causing it to go down.

DiffServ is a class-based model that uses the DSCP field in the IP header to classify traffic. It provides per-hop behavior (PHB) and is scalable because core routers only need to inspect the DSCP field. The model does not guarantee end-to-end bandwidth reservation like IntServ does; instead, it relies on traffic conditioning at the edge.

The 'state: replaced' will replace the entire interface configuration with only the provided parameters. This means that any existing configuration on GigabitEthernet0/1 (like IP address, speed, duplex) will be removed and only the description and enabled state will be applied. This is a common pitfall.

EIGRP uses a maximum hop count of 100 by default to prevent routing loops. This is a hard limit; if a route's hop count exceeds 100, EIGRP considers it unreachable. This value is configurable via the 'metric maximum-hops' command under the EIGRP process.

ISE profiles endpoints by collecting attributes, then matches the profile to a policy, downloads a dACL to the switch, and the switch applies it to the port.

SPT is a source-specific tree rooted at the source; RPT is a shared tree rooted at the RP; Bidir tree is a shared tree used in Bidir PIM; (*,G) tree is a shared tree for all sources; (S,G) tree is a source-specific tree.

In MPLS, the ingress LSR pushes a label onto the packet, and transit LSRs swap the incoming label with an outgoing label based on the LFIB. PHP removes the label before the egress LSR, so the egress LSR does not perform a label lookup. The egress LSR forwards based on the IP header after label removal.

DHCP snooping first validates DHCP server messages on trusted ports, then creates a binding entry from the DHCPACK, stores the entry with MAC/IP/port/VLAN, updates the table on lease renewal, and finally removes the entry on lease expiry or DHCPRELEASE.

DAI first intercepts ARP packets on untrusted ports, then checks the sender MAC and IP against the DHCP snooping binding, validates ARP cache consistency, drops packets that mismatch, and finally forwards valid packets to the destination.

In IGMPv3 SSM, the host first sends a membership report with (S,G) inclusion, the querier processes it, updates its state, and then triggers PIM (S,G) join toward the source.

LACP is IEEE 802.3ad standard, used by all vendors; PAgP is Cisco proprietary.

In DMVPN Phase 2, the spoke sends an NHRP Resolution Request to the hub to learn the public address of the destination spoke. The hub forwards this request to the destination spoke, which replies with an NHRP Resolution Reply containing its public address. The hub forwards the reply back to the requesting spoke, and then the two spokes establish a direct tunnel.

The correct order of steps for parsing 'show interfaces' output using TextFSM is: first, capture CLI output from the device (A); second, load the TextFSM template file (B); third, initialize the TextFSM parser with the template (C); fourth, parse the output using the ParseText method (D); finally, access the structured data as a list of dictionaries (E). This sequence follows the logical workflow of a script: obtain raw data, set up the template, apply the parser, and retrieve structured results.

The cisco.dnac.vlan module requires the 'site_id' parameter to associate the VLAN with a specific site. If the site_id is not provided or is incorrect, the task will fail or create the VLAN in the wrong location. Additionally, the playbook assumes the DNA Center credentials are correctly set.

Authentication verifies identity; Authorization determines permitted actions; Accounting tracks usage for auditing or billing.

The bulk walk starts with GetBulkRequest, retrieves multiple rows, then iterates until the end of the MIB subtree.

IPv6 ACLs use ipv6 access-list instead of access-list; They match on IPv6 source/dest addresses; They support the same permit/deny actions; They can use named entries; They can log matches similarly.

DMVPN phase 2 allows spoke-to-spoke tunnels after initial hub registration, using NHRP to resolve destination addresses and enabling direct traffic flows.

Correct pairings: container groups related nodes; leaf holds a single scalar value; list defines a sequence of entries; leaf-list holds an ordered set of scalar values; typedef defines a new derived type.

The ZTP flow begins with the device obtaining an IP address via DHCP, then contacting the cloud portal to authenticate and receive the vManage list, followed by establishing a DTLS connection to vManage, downloading the full configuration, and finally joining the control plane.

Centralized control policies are applied on vSmart to influence routing (e.g., path selection), while localized data policies are applied on edge devices for QoS, ACL, and forwarding. App-route policies are a type of centralized data policy. vManage is for configuration, not policy enforcement. Centralized data policies are applied on vSmart, not edge devices.

Redistribution requires enabling redistribution, setting a seed metric (or using default-metric), optionally matching routes, and then verifying. The order ensures routes are properly injected.

RRM dynamically adjusts channel and power settings based on RF measurements, uses a leader AP to coordinate, and can be configured to run at a scheduled interval. It does not require a dedicated hardware controller (it runs on the WLC) and does not automatically enable client load balancing (that is a separate feature).

In Ansible, inventory grouping starts with defining groups and hosts, then applying group variables with precedence: all group vars are overridden by parent group vars, which are overridden by host vars, and finally by ansible_host connection details.

The script connects to the device, enters configuration mode, applies the telemetry subscription commands, and prints the output. The commands are syntactically correct for IOS-XE, so the configuration should be applied successfully.

Cisco DNA Center uses intent-based networking to automate network changes. The correct answers highlight key automation capabilities: PnP for zero-touch provisioning and the ability to push configuration templates via CLI or REST API. The wrong answers misstate the role of APIC-EM (a predecessor), the GUI-only limitation, and the integration with ISE for policy rather than device discovery.

The privileged EXEC mode (enable mode) is protected by either the `enable password` or `enable secret` command. The `enable secret` command uses a stronger MD5-based hash (or SHA-256 in newer IOS versions) to store the password, making it the recommended method. Both commands restrict access to privileged EXEC mode by requiring a password before executing `enable`.

A 429 error indicates rate limiting; the API has received too many requests from the client within a given time frame. The engineer should implement exponential backoff and retry logic, or reduce the request rate.

CoPP classes map to specific traffic categories: routing protocol traffic, management traffic, exception traffic, and default catch-all.

PortFast moves a port to forwarding immediately; BPDU Guard err-disables a port upon BPDU reception; Root Guard prevents a port from becoming root; Loop Guard prevents alternate/backup ports from transitioning to forwarding.

MPLS L3VPNs use VRFs for isolation, MP-BGP for route exchange, and MPLS labels for forwarding, with the provider core unaware of customer routes.

The control plane handles OMP and routing protocols; the data plane forwards traffic using IPsec tunnels; the management plane provides CLI/GUI and APIs; the orchestration plane handles zero-touch provisioning and authentication.

The correct order is: first power on the VM (A) to ensure it is running, then take a snapshot (B) to capture the current state, then perform changes on the running VM (E), then power off the VM (C) before reverting, and finally revert to the snapshot (D) to restore the VM to the captured state. This sequence ensures that the snapshot is taken before changes, and the revert happens after changes are made and the VM is powered off.

To configure TLS on the gRPC connection. gRPC supports TLS for encryption, and on IOS-XE, this requires configuring a trustpoint and enabling TLS under the telemetry receiver. The other options are incorrect because IPsec is not directly integrated with gRPC telemetry; SSH is used for NETCONF, not gRPC; and DTLS is used for UDP-based telemetry, not gRPC.

Correct: VRF-lite uses static or dynamic routing; it does not require MPLS; it provides path isolation. Incorrect: VRF-lite does not support MPLS VPN inter-AS; it does not require BGP; it does not use label switching.

Mobility groups allow seamless client roaming across controllers, support up to 24 controllers per group, require symmetric mobility tunnels, and use a backup controller list for redundancy. They do not require all controllers to be in the same subnet or same hardware model.

Methods use different combinations of source/destination MAC, IP, or port to compute hash for link selection.

The `ip summary-address eigrp TEST 10.0.0.0 255.0.0.0 5` command creates a summary route of 10.0.0.0/8 with an administrative distance of 5, which is advertised out of GigabitEthernet0/0. The EIGRP process name TEST matches the router eigrp configuration, and the summary is generated regardless of the network statements, as long as the router has a more specific route within the summarized range.

Flexible NetFlow setup begins with defining the flow record to specify what to match and collect, then defining the flow exporter to set destination and transport, followed by creating the flow monitor that binds record and exporter, then applying the monitor to an interface, and finally verifying with show commands.

The configuration uses a local SPAN session to copy traffic from a source interface (GigabitEthernet1/0/1) to a destination interface (GigabitEthernet1/0/2). The keyword 'both' specifies that both ingress and egress traffic on the source port are mirrored, so all traffic entering and leaving GigabitEthernet1/0/1 is sent to the destination port for monitoring.

Redistribution requires first configuring the routing process that will receive the routes, then defining the source protocol and metric, optionally setting route tags for loop prevention, applying a route map for filtering, and finally verifying the redistributed routes appear in the OSPF database.

Cisco DNA Center uses model-driven telemetry (e.g., gRPC, NETCONF/YANG, or UDP-based push) to stream real-time data from network devices, enabling sub-second analytics and faster troubleshooting compared to traditional polling methods like SNMP.

ESP provides confidentiality, data integrity, and optional anti-replay; AH provides data integrity and authentication but no encryption; ESP with null encryption provides integrity only; combined ESP+AH provides both confidentiality and integrity; anti-replay is a service provided by both ESP and AH.

The correct order follows YANG module processing: first the module is imported, then its base schema is parsed, next augmentations are resolved, then conflicts are detected, and finally the complete schema tree is built.

First a sensor path is defined, then a subscription is created with destination, the device pushes data periodically, the collector receives and processes, and the subscription can be updated or deleted.

This subscription uses on-change update policy, so data is pushed only when a change occurs in the specified subtree.

Path isolation with VRF ensures that traffic from different tenants or departments does not interfere. The correct answers highlight that VRFs provide separate forwarding tables, that overlapping IP addresses are possible, and that VRF-lite can be used without MPLS. The incorrect options claim that VRFs guarantee end-to-end encryption (they do not) or that VRF-lite requires a full mesh of trunks (it does not).

The script stores the enable secret in plain text. In a production environment, credentials should be stored securely, such as using environment variables or a vault. DNA Center itself stores credentials encrypted, but this script exposes them.