ENCOR 350-401 (350-401) — Questions 451–525

MACsec (802.1AE) provides hop-by-hop encryption and integrity check for Ethernet frames. It encrypts the payload and adds an integrity check value (ICV) to detect tampering. This is correct: it operates at Layer 2 and secures the data link between two directly connected devices.

In SD-Access, border nodes connect the fabric to external Layer 3 networks (e.g., WAN, data center, Internet) by translating VXLAN encapsulated traffic to traditional routing. They advertise fabric IP prefixes externally and support inter-site VXLAN data plane, handling north-south and east-west inter-site traffic. They also enforce policy and host the LISP control plane for external reachability.

Without the address-family ipv4 vrf CUSTOMER_A command under BGP, the PE does not establish an internal BGP session for that VRF nor inject connected/static routes into VPNv4. This means no VPNv4 routes are generated for CUSTOMER_A, and no remote VPNv4 routes are imported into the VRF, so only the directly connected CE subnet is reachable. Activating the VRF in BGP is the mandatory prerequisite for inter-site route exchange in MPLS Layer 3 VPN.

Cisco IOS ACLs automatically append an implicit 'deny ip any any' at the end of every access list, so any traffic not explicitly permitted is discarded without further configuration. The explicit 'deny ip any any' is therefore redundant—it does not change the outcome but can still be included for clarity, to generate logging via the 'log' keyword, or to make the default behavior visible to someone reading the config. Removing it would not alter the security posture.

This statement is correct. The 'overload' keyword makes the router perform Port Address Translation (PAT), where all hosts from the 192.168.1.0/24 network that are matched by the access list have their source IP addresses translated to the IP address configured on GigabitEthernet0/0. Unique source port numbers are assigned to each concurrent connection, allowing many internal hosts to share the single public interface IP.

The output definitively shows that for GigabitEthernet0/0, the DR column lists 10.1.1.1. In PIM Sparse Mode, the DR is the router with the highest IP address on the subnet unless priority overrides, and the address shown is the elected DR for that interface. Therefore, the statement matches the command output and is correct.

Cisco StackWise Virtual enables active/active forwarding, meaning both switches in the virtual domain can forward traffic concurrently. This provides load balancing and increased bandwidth utilization. Multichassis EtherChannel (MEC) leverages this capability, allowing access switches to form a port-channel with both distribution switches for redundancy and increased throughput.

Policing uses a token bucket (or single/two-rate policer) to measure traffic arrival against a configured committed information rate (CIR) and burst size. Packets that conform are forwarded unchanged, while excess packets are either dropped or have their precedence/DSCP marked down (e.g., set to a lower drop probability). This fits the classic definition of policing, which is a rate-limiting action that takes immediate action on nonconforming packets without buffering.

CRC errors indicate that frames are being corrupted during transmission, which is commonly caused by cable interference, damage, or poor quality cabling. The CRC checksum fails when bits are altered, so the issue is likely at the physical layer. This is the most probable cause.

SXP is a control-plane protocol that maps IP addresses to SGTs and is used to propagate SGT information to devices that cannot perform inline tagging, such as older switches or routers. It allows these devices to enforce SGACLs based on the SGT mapping. This is a key component of TrustSec for mixed environments.

A stateful firewall or load balancer that performs TCP proxy or stateful inspection can intercept the inbound SYN and reply with a SYN-ACK on behalf of the backend server. The IP SLA TCP connect operation only confirms that it received a SYN-ACK, so the handshake appears successful even if the actual server is down or unreachable. Because the intermediary completes the three-way handshake, the probe incorrectly reports an RTT of 100 ms while real application traffic still fails.

The vSmart controller is the centralized policy and control plane component of Cisco SD-WAN. It distributes OMP routes and policies to vEdge routers, enabling per-application traffic steering across MPLS and Internet transports. It does not forward data traffic; it only manages control plane and policy. This matches the requirement for centralized policy in a controller-based architecture.

Memory overcommitment lets the hypervisor assign more RAM to VMs than the host physically holds, relying on reclaim techniques such as ballooning, swapping and transparent page sharing to satisfy actual demand. This directly satisfies the stem's requirement that total VM memory allocations may exceed physical host RAM.

Setting the link type to point-to-point marks the switchport as a direct, full-duplex connection between exactly two switches, which lets Rapid Spanning Tree (RSTP/Rapid PVST+) invoke its proposal/agreement mechanism. Once the root port sends a proposal and receives agreement from the downstream designated port, the port can enter the forwarding state immediately instead of waiting through the default 15-second listening and 15-second learning timers. This fast transition is the key benefit of RSTP over classic 802.1D STP and is only used when the link is treated as point-to-point.

Fabric edge nodes are responsible for enforcing group-based policies using Scalable Group ACLs (SGACLs). They encapsulate traffic with VXLAN and include the source group tag (SGT) and destination group tag (DGT) in the VXLAN header. Based on these tags, the edge node applies the appropriate SGACL. This enforces segmentation between user groups even when they share the same physical network.

Policing meters traffic against the token bucket and, instead of dropping, can mark conforming or exceeding packets with a new DSCP or IP precedence value, lowering their priority downstream. This satisfies the requirement to re-mark excess traffic.

With port security in violation mode restrict, the switch dynamically learns secure MAC addresses up to the configured maximum of two. When a third distinct source MAC appears, frames from that unknown MAC are dropped by the port, but the port remains administratively up and operational for the two learned addresses. Restrict does not disable the interface; it silently discards violating traffic and increments the security violation counter, which is exactly what this scenario describes.

The translation table shows two entries both sourced from inside local 10.0.0.20, and both are assigned the same inside global address 192.0.2.20. The differentiator between the sessions is the source port, which is the defining behavior of Port Address Translation (PAT) / NAT overload. PAT lets one internal host sustain multiple concurrent TCP or UDP flows through a single public IP by rewriting each packet's source port along with the IP address, which matches the entries given in the question.

This configuration filters ingress traffic on GigabitEthernet0/1 by matching ICMP packets with type 8, which is the Echo request used by ping. Because the access-group is applied in the inbound direction, any ICMP Echo request arriving on the interface is denied and dropped, while every other packet—including other ICMP types and all IP protocols—matches the final permit ip any any and is permitted. The result is precisely that inbound ICMP Echo requests (pings) are blocked, but nothing else is affected.

The underlay is typically a Layer 3 routed network that uses a routing protocol to ensure loop-free paths. It does not rely on Spanning Tree Protocol, which is a Layer 2 loop prevention mechanism. This is a correct characteristic of the SD-Access underlay.

Application Health provides detailed metrics on application performance, including network latency, jitter, and packet loss for specific applications like voice. It can help determine if the voice quality issue is due to the application itself or the network path. By analyzing application-specific data, the administrator can isolate whether the problem is within the application or the underlying network.

Cisco DNA Center returns HTTP 202 Accepted for asynchronous operations, including site creation. The response includes a task ID, and the site is not fully created until that task reaches a success state. The device assignment fails because the site does not yet exist. The team must poll the task endpoint until completion before proceeding.

Within the DHCP pool configuration mode, the 'dns-server' command specifies the DNS server IP address that DHCP clients will receive. This is the correct command to provide DNS information to clients. It is configured under 'ip dhcp pool' and can list multiple DNS servers. This ensures clients can resolve domain names. The command is essential for proper network operation when DHCP is used for address assignment.

When 802.1X is configured with a RADIUS server, such as Cisco ISE, the server can return attributes that instruct the switch to place the authenticated endpoint into a specific VLAN. This is done using the IETF RADIUS attribute Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID. The switch then dynamically assigns the port to that VLAN. This feature is supported on Catalyst 9000 switches and is the standard method for dynamic VLAN assignment.

LISP separates endpoint identity (EID) from routing locator (RLOC), which is exactly the identifier/locator split the scenario demands. VXLAN provides the tunneling data plane over the routed underlay, and the fabric border and edge nodes register EIDs to the map server. Together they deliver Layer 2 and Layer 3 overlay connectivity without stretching VLANs across sites.

RESTCONF DELETE against the exact data node URL removes the targeted VLAN instance; with VLAN 10 present, IOS-XE returns 204 No Content and the VLAN is removed from the running configuration. The URL path identifies the list entry, so the operation succeeds.

SD-WAN is purpose-built for active/active WAN utilization: it establishes secure overlay tunnels across both transport links and uses centralized or distributed policy-based routing to steer traffic per application, class, or SLA. This allows both links to carry production traffic simultaneously, with dynamic path selection for load balancing and fast reroute if one link degrades or fails. The policy engine also factors in real-time loss, latency, and jitter, making it the only option that truly satisfies the requirement to actively use both links.

RESTCONF maps CRUD operations onto standard HTTP verbs, so GET retrieves, PUT replaces, POST creates, DELETE removes and PATCH merges configuration data. This satisfies the stem's requirement for a true statement, since RESTCONF is defined by the IETF as a RESTful, HTTP-based protocol operating on YANG-modelled data.

Cisco Meta Data (CMD) is the inline tagging method that embeds the SGT directly into the Ethernet frame using a special EtherType. It allows SGT propagation across Layer 2 trunks without requiring SGACL enforcement on every switch. This is the correct technology for carrying SGT information inline in the frame, enabling TrustSec propagation across the campus.

The default authentication method list must name 'group tacacs+' as the first method because Cisco AAA evaluates method list entries in order and stops at the first success or failure. With only 'local' configured, the router never sends the username and password to the TACACS+ server, so TACACS+ users cannot authenticate. Adding 'group tacacs+' before 'local' still preserves local as a fallback if the TACACS+ server is unreachable, which is exactly the correct fix for this scenario.

When the SPAN destination port resides in the same VLAN as the source interface, the switch forwards the replicated frames into the same broadcast domain, which can cause a bridging loop. To prevent this, loop prevention mechanisms—typically STP and hardware protections—drop those copied frames, resulting in no traffic arriving at the analyzer. The destination port must be placed in a different VLAN or made a dedicated SPAN destination to avoid this loop-avoidance drop.

The transport input ssh command on the VTY lines restricts inbound management sessions to SSH, effectively disabling Telnet. Setting the SSH version to 2 with ip ssh version 2 ensures only the stronger protocol version is negotiated. Together these commands satisfy the requirement to allow only SSHv2 and block Telnet.

CoPP is implemented using MQC constructs where a class map matches control plane traffic and a policy map defines policing actions. The policy map is then applied under the control-plane configuration mode using the service-policy command, which directs the policy to the route processor's traffic rather than to data plane interfaces.

The 'bandwidth percent 30' command guarantees that the class AF31 receives at least 30% of the interface bandwidth during congestion. This is a CBWFQ configuration that provides a minimum bandwidth guarantee, ensuring that AF31 traffic is prioritized while allowing other classes to use the remaining bandwidth. It directly satisfies the requirement.

The CoPP policy likely does not have a class-map for SNMP, so SNMP packets fall into the default class and may be dropped by the default policer. Adding a specific class-map for SNMP (UDP 161) with a suitable policer ensures SNMP traffic is permitted at the required rate while still protecting the control plane from excessive SNMP traffic.

With Port Address Translation (PAT), a single public IP can support at most about 65,000 simultaneous translations because each session must use a unique source port (1–65535, minus reserved). When the router's NAT table reaches this limit, it drops new connection attempts, denying translations for additional inside hosts. As existing sessions age out or are cleared, the table frees ports, allowing new connections to succeed, which matches the intermittent failure pattern described. High concurrent sessions—common with web browsing, streaming, or file transfers—can easily fill the table.

MAB is enabled on an interface with the 'mab' command in interface configuration mode. This allows the switch to use the device's MAC address as the username and password for RADIUS authentication when 802.1X times out. It is the standard method to support non-802.1X devices like printers. The other commands do not enable MAB.

Using a loopback interface as the VTEP source ensures high availability because it remains up as long as any path to the underlay exists. Advertising the loopback IP into OSPF makes it reachable by remote VTEPs, enabling VXLAN tunnels to form. This is the recommended design for VXLAN in Cisco Nexus environments.

Cisco-specific YANG models typically have a namespace URI containing 'cisco.com' and are designed to expose Cisco IOS XE-specific features and operational data. They complement standard models by providing access to proprietary functionality. For example, Cisco-IOS-XE-native is a common model for native configuration. This statement accurately describes their naming and purpose.

Client 360 in Cisco DNA Center Assurance provides a comprehensive view of a specific client's connectivity, including historical trends, onboarding information, and detailed event timeline. It allows the administrator to drill down into the client's connectivity issues, view past sessions, and identify root causes such as authentication failures or RF problems. This is the correct tool for troubleshooting a single client's intermittent drops.

VLAN 30 is not created in the VLAN database on SW2. A trunk link will forward frames for a VLAN only if that VLAN exists in the local VLAN database of the switch; otherwise the switch drops the frames as ingress/egress filtering prevents unknown VLANs from crossing the trunk. Even though SW1 has VLAN 30 configured and the allowed list on SW2 may include VLAN 30 by default, SW2 cannot pass frames for a VLAN it does not know. Creating VLAN 30 on SW2 (or using VTP to propagate it) is required for end-to-end connectivity.

Centralized data policy on vSmart is the only mechanism that combines application identification (via DPI or NBAR) with real-time SLA metrics (loss, latency, jitter) to dynamically steer traffic over the best overlay tunnel. The policy is defined centrally on vSmart and then distributed to vEdge routers as part of the OMP route and policy updates, allowing network-wide, consistent forwarding decisions. This makes it the correct solution for application-aware path selection based on live link conditions.

VXLAN encapsulates Layer 2 frames in UDP and uses a 24-bit VXLAN Network Identifier (VNID), which provides up to 16,777,216 unique segments. This scalability is a key advantage over VLANs, which are limited to 4094. The large VNID space supports multi-tenant data centers and large-scale segmentation in SD-Access.

LOCAL_PREF is evaluated early in the BGP best-path algorithm, before AS_PATH and origin. A higher value signals local preference, so the route with the greater LOCAL_PREF wins, directly satisfying the statement about preference ordering between competing paths.

The transport input ssh command restricts VTY lines to SSH only, blocking Telnet, while ip ssh version 2 forces the router to negotiate only SSHv2 sessions. Together they satisfy both requirements. This is the canonical method on Cisco IOS XE for enforcing SSHv2-only management access.

HSRP requires all participants to be in the same Layer 2 broadcast domain because hello messages are multicast onto the local VLAN. The multicast destination is 224.0.0.2 (HSRPv1) or 224.0.0.102 (HSRPv2) with a TTL of 1; if the interfaces reside in different VLANs, the broadcast domains are isolated, so the hellos never reach the peer and no HSRP adjacency forms. The virtual IP must also belong to the same IP subnet as the real interface IPs, and that subnet maps to exactly one VLAN; different VLANs imply different subnets and break the redundant gateway function.

When the DHCP relay agent receives a broadcast on an interface in the GUEST VRF, it generates a unicast DHCP request to the server address specified by ip helper-address, but it consults the GUEST VRF routing table to determine the egress interface and next hop. Because the DHCP server resides in the CORP VRF, the GUEST VRF routing table does not have a route to that server IP, so the relay packet is silently dropped. A route leak or a static route from the GUEST VRF to the CORP VRF (and back) is required to allow the unicast relay traffic to span the VRFs.

This is the correct diagnosis. For the IP SLA UDP jitter operation (type 'udp-jitter'), the source router sends a burst of packets per probe—by default 10—and measures the inter-arrival time differences among the returned packets to compute jitter. If the engineer set the 'num-packets' parameter to 1, only a single packet is sent per probe, so there are no two consecutive packets from which to calculate delay variation. The result is that jitter is reported as zero, not because the network has no variation, but because the probe lacks the required packet pair.

The 'ip dhcp excluded-address' command is used to specify a range of IP addresses that the DHCP server should not assign to clients. This is typically used for addresses that are statically assigned to servers, printers, or other network devices. It ensures that the DHCP server does not hand out these addresses, preventing conflicts.

The NFVO performs both network service orchestration and resource orchestration, coordinating across multiple VIMs. This cross-domain scope distinguishes it from the VNFM, which manages individual VNF instances rather than end-to-end services spanning several virtualised infrastructures.

MKA is a protocol defined in IEEE 802.1X-2010 that handles key agreement for MACsec. It elects a key server, distributes secure association keys (SAKs), and manages key rotation. On Cisco switches, MKA must be enabled with a pre-shared key or 802.1X-derived CAK. This statement correctly describes how MACsec establishes and maintains cryptographic keys between peers.

Dial-out subscriptions invert the usual model: the router or switch initiates the session and pushes telemetry to a preconfigured collector, rather than awaiting a receiver's request. This matches the stem's requirement for a true statement about subscription types.

Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices. It handles device-specific prompts, paging, and other nuances, allowing engineers to send configuration commands and retrieve output easily. It supports Cisco IOS XE and many other vendors. For a beginner needing a high-level interface without dealing with low-level details, Netmiko is ideal. It abstracts the complexities of SSH and device interaction.

IKEv2 requires a proposal (encryption, integrity, DH group) and a policy to associate the proposal with the profile. Without these, the IKEv2 negotiation will fail.

The 'show bgp l2vpn evpn' command displays the EVPN routes in the BGP table, including Type-2 and Type-3 routes for MAC and IMET. By checking this output, the engineer can verify whether the VNI is being advertised. If the VNI is not present, it indicates a configuration issue with the EVPN control plane, such as missing VNI configuration under the EVPN address family or BGP neighbor issues.

The `encode-kvgpb` setting selects key-value Google Protocol Buffers encoding, compacting the YANG-modelled CPU telemetry into a schema-driven binary format. This satisfies the subscription's requirement to stream efficiently to the gRPC receiver at 10.10.10.10:5555, since protobuf serialisation is far smaller than JSON or XML payloads over the same periodic 500-centisecond interval.

HSRP version 1 uses the virtual MAC address 0000.0c07.acXX, where XX is the group number in hexadecimal, and it supports only IPv4. Configuring HSRPv1 with the standby command and a group number satisfies both requirements, making it the correct choice for this scenario.

WAN Edge routers are responsible for establishing BFD sessions with each other. BFD is used to detect link failures and measure quality metrics such as latency, jitter, and packet loss. These sessions are established over the data plane, typically over IPsec tunnels or direct links. The WAN Edge routers send BFD packets periodically and use the results to make routing decisions. Therefore, they are the component that establishes and maintains BFD sessions.

This is correct. On Cisco Catalyst switches, the default authentication method order is determined by the priority values: dot1x (10), mab (20), and webauth (30). The switch first attempts 802.1X to authenticate the supplicant; if that fails or times out, it falls back to MAC authentication bypass (MAB). If MAB also fails or is not applicable, the switch then falls back to web authentication as the final method. This ordering ensures the most secure method is attempted first, with less secure methods as fallbacks.

This command configures the SPAN session to use VLAN 10 as the source, capturing all traffic within that VLAN. It is the correct first step to monitor VLAN traffic. The destination is then configured separately with the monitor session destination command.

CoPP works by classifying traffic into distinct classes and applying individual policers. Creating separate class-maps for each protocol allows the engineer to set appropriate rates for BGP and OSPF while still policing SSH and SNMP. This targeted approach protects the control plane without starving routing protocols, resolving the flapping while maintaining security.