ENCOR 350-401 (350-401) — Questions 526–600

Golden images let administrators designate an approved software version per device family, satisfying the requirement for consistent, enforced versions across the fleet. Compliance checks then flag or remediate devices running non-golden images, standardising the network.

OMP runs only between vSmart controllers and vEdge/cEdge routers, carrying route prefixes, TLOC attributes, policies and service-side information in a single protocol. That combined routing, policy and service exchange is exactly what the stem's overlay routing statement requires.

CBWFQ is correct because it provides a guaranteed minimum bandwidth to each class during congestion, based on the configured bandwidth value, while allowing classes to use unused bandwidth from others. This matches the requirement for a guaranteed floor with excess sharing. It is implemented with the bandwidth command inside a policy-map class.

This configuration sets the access VLAN to 60 for the PC and the voice VLAN to 50 for the phone. The phone will use VLAN 50 for voice traffic and pass untagged PC traffic to VLAN 60. This is the standard Cisco configuration for a phone with a PC attached.

A 429 Too Many Requests response signals that the client has hit a server-enforced rate limit, and the standard remedy is to wait and retry. Exponential backoff increases the delay between each retry (e.g., 1s, 2s, 4s) to avoid hammering the API, and it aligns with the server's expectation that the client will back off; optionally, you can combine it with the Retry-After header if provided. This is the widely recommended pattern for resilient API clients.

Creating a separate WLAN for guests and mapping it to a dynamic interface with its own VLAN isolates guest traffic from internal networks. The dynamic interface can be configured with an ACL or firewall rules to restrict guests to internet-only access. This approach ensures that guest traffic is segregated at Layer 2 and can be controlled at Layer 3.

Named mode is entered globally with router eigrp followed by an arbitrary process name, replacing the classic autonomous-system-number syntax. This single named process then hosts one or more address families, which is the structural change that defines EIGRP named mode configuration.

Enabling unicast routing on the bridge domain allows the ACI fabric to perform Layer 3 routing between subnets within the bridge domain and to external networks. This is required for the Layer 3 gateway services specified in the scenario, as the bridge domain acts as the default gateway for endpoints.

Idempotency means a module checks the managed node's current state and only applies changes needed to reach the declared state, so repeated playbook runs converge on the same result without duplicating actions. This matches the statement that multiple runs produce an identical final state.

Configuring the port-channel with 'channel-group 1 mode active' makes the switch actively transmit LACPDUs on the member link, initiating the IEEE 802.3ad negotiation with the server. Because LACP active mode reliably establishes the EtherChannel with any peer that is either active or passive, it is the safest choice when the server's exact teaming settings are unknown. This mode also allows the switch to detect and manage the bundled link using the standard LACP state machine.

VRF-lite creates multiple independent routing and forwarding tables on one device without MPLS, letting interfaces be assigned to separate instances. This satisfies the stem's requirement for multiple routing instances on a single router using distinct tables.

The command "ip multicast-routing distributed" enables multicast routing in global configuration and, on supported distributed platforms, enables CEF-based multicast forwarding using the Multicast Forwarding Information Base (MFIB) on line cards. Combined with "ip pim sparse-dense-mode" on an interface, the router will initially send PIM joins or use dense-mode behavior depending on whether an RP is known for a given multicast group; if an RP is known (static, BSR, or Auto-RP), sparse-mode is used, otherwise the group operates in dense-mode. This is the correct interpretation of both the command and PIM mode behavior.

Configuring a tracking object (track 1 ip sla 1 reachability) and associating it with the static route (ip route 10.1.1.0 255.255.255.0 192.168.1.2 track 1) allows the router to remove the route when the IP SLA operation fails. This provides automatic failover based on reachability.

The 'always' keyword in the 'default-information originate' command forces OSPF to generate and advertise a default route (0.0.0.0/0) throughout the entire OSPF domain, irrespective of whether a default route exists in the routing table. This guarantees connectivity to external networks via the advertising router even when it has no default route of its own, preventing blackholing in certain topologies.

The VTEP is responsible for encapsulating original Layer 2 frames into VXLAN UDP packets, adding a VXLAN header, and forwarding them across the IP underlay network. It also decapsulates received VXLAN packets, making it the core component for overlay connectivity.

SGACLs enforce policies based on SGTs.

RESTCONF is a REST-based protocol that uses HTTP methods (GET, POST, PUT, PATCH, DELETE) and supports JSON encoding. It is enabled on IOS XE with the 'restconf' command and uses the HTTPS server. This matches the requirement to retrieve interface status programmatically with JSON and HTTP.

This is correct because the access-list entry 'permit tcp 192.168.1.0 0.0.0.255 any eq 80' matches packets that enter the chosen interface (inbound direction) with a source IP in 192.168.1.0/24, any destination IP, and a destination TCP port of 80 (HTTP). Once this permit statement is evaluated and no other permit entries exist, the implicit deny all at the end of the ACL causes all other inbound traffic to be dropped. Therefore only HTTP from the specified subnet is allowed; everything else is denied.

VXLAN overlay with policy-based forwarding is the correct approach because it uses VXLAN Network Identifiers (VNIs) to create scalable, isolated tunnels that can span the hypervisor without physical topology constraints. Traffic can be steered through a desired sequence of VNFs by applying policies based on packet attributes or VNI, allowing seamless insertion, removal, or reordering of VNFs without reconfiguring the underlying network.

Cisco DNA Center provides the design and provisioning workflow for SD-Access, satisfying the stem's requirement. Through its fabric designer, administrators define virtual networks, host pools, and underlay settings, then DNA Center automates device configuration and fabric deployment across the campus, removing manual CLI provisioning.

The command 'switchport mode trunk' configures the interface to operate as a trunk, allowing it to carry traffic for multiple VLANs. This is necessary for connecting a WLC that needs to support multiple VLANs. It is the standard command to set a port to trunk mode on Cisco switches, enabling 802.1Q encapsulation.

The exhibit's AAA configuration binds a named method list, CONSOLE, to the console line, and that list contains only the keyword 'local', so console logins check the local user database. VTY lines are not bound to any custom list, so they inherit the default method list, which also specifies local authentication. For accounting, the command `exec accounting start-stop tacacs+` is globally configured, meaning each EXEC session's start and stop are recorded and sent to the TACACS+ server. Therefore, authentication remains local for both access types, but accounting traffic is forwarded to TACACS+.

HSRP satisfies the default gateway redundancy constraint by having routers share a virtual IP and MAC address, so hosts keep one gateway address. The active router forwards traffic; if it fails, the standby assumes the virtual address, preserving gateway availability without host reconfiguration.

vSmart controllers run the OMP overlay, receiving routes from vEdge routers and redistributing them alongside centralised policies. This satisfies the stem's requirement for a true control plane statement: vSmart handles route and policy distribution, while vManage provides management and vBond handles orchestration and authentication.

The command 'ipv6 ospf 1 area 0' is the correct IOS interface subcommand to enable OSPFv3, the IPv6-capable version of OSPF, on that link. It starts OSPFv3 process 1 for that interface and places the interface in backbone area 0, which is the mandatory area that interconnects all other areas. The process ID is locally significant, and the area ID is a 32-bit value, with '0' being shorthand for 0.0.0.0.

The authentication event fail action authorize vlan command on the switch port directs hosts that fail 802.1X authentication into a specified restricted VLAN. This exactly matches the requirement to isolate failed devices. It is the correct IOS configuration to define failure handling behavior for the port and is essential for the design described.

The default OMP hello interval is 10 seconds. OMP peers (vSmart and vEdge/cEdge) exchange hello keepalives every 10 seconds over the DTLS/TLS control-plane tunnel to verify that the peer is alive and to maintain the session. This timer is the Cisco SD-WAN default and is not changed by any standard configuration, making 10 seconds the correct answer.

This error from Netmiko/Paramiko means the SSHTransport object is not in an active state when invoke_shell() is called. On Cisco devices, this commonly occurs when the device is still booting and the SSH server has not fully initialized—for example, RSA keys are still being generated—so the server accepts TCP but aborts the SSH protocol handshake, leaving the client transport inactive.

CPU affinity (often called core pinning) is the only mechanism that directly maps a VM's vCPUs to specific physical cores (pCPUs) in the hypervisor's CPU scheduler. By creating a 1:1 binding between each vCPU and a designated physical core, the hypervisor will not schedule any other vCPU or host process on those pinned cores, giving the VM exclusive, dedicated access. This is precisely what the network engineer needs for a latency-sensitive virtual network function, because it eliminates core-sharing contention and provides deterministic and consistent performance.

This is correct because the command output unambiguously lists 'Private VLAN Type: Primary' under VLAN 10's configuration, along with its associated secondary VLANs. A primary private VLAN is the root VLAN that carries upstream/downstream traffic and interconnects promiscuous ports with the secondary VLANs mapped to it. The presence of associated secondary VLAN fields confirms VLAN 10 is the primary in this private VLAN domain, making this the accurate description.

Type 2 MAC/IP Advertisement routes carry the host MAC address and optionally the host IP address, along with the originating VTEP, for a given VNI. Advertising Type 2 routes lets remote leaf switches install MAC and ARP/ND entries and forward unicast traffic directly, avoiding flooding for known hosts.

A NetFlow flow is defined by a one-way tuple of source and destination addresses, ports, and protocol, so each record describes traffic in a single direction. Return traffic generates a separate record, which is why bidirectional analysis requires correlating two flows.

The IEEE 802.1s MST region is identified by a computed configuration digest, which is derived from the VLAN-to-instance mapping, the region name, and the revision number. If one switch in Region 1 uses a different mapping (for example, VLAN 10 assigned to instance 2 instead of instance 1), its digest differs even if the name and revision match. Switches with different digests cannot distinguish internal MST BPDUs from external ones, so they treat each other as separate regions, causing an incorrect top-level tree and per-instance topology. This is exactly the failure symptom described in the scenario.

Netmiko's 'secret' supplies the enable password, which the library sends after login to escalate from user EXEC to privileged EXEC mode. Without it, commands such as 'show ip interface brief' that require elevated privileges would be rejected by the IOS-XE device.

The OSPF dead timer is the primary factor in convergence delay because it dictates how long a router waits for a missing hello before marking the neighbor unavailable. Setting the dead timer to 1 second ensures that a link failure is detected within roughly one second, and a hello interval of 333 milliseconds satisfies the standard three-hello requirement while maintaining a stable neighbor state. This direct reduction of the detection timer cuts the outage from tens of seconds to about one second, whereas other mechanisms only optimize post-detection processing.

In Cisco SD-Access, the fabric control plane node runs the LISP map-server and map-resolver functions, maintaining the endpoint identifier (EID) to routing locator (RLOC) mappings for all fabric endpoints. This provides host tracking, location, and a unified control plane for both wired and wireless clients. The control plane node is essential for scalable fabric operations and policy enforcement through group-based policies.

The command 'switch convert mode virtual' converts a standalone switch to StackWise Virtual mode. This is required before the switch can join an existing StackWise Virtual domain. It changes the switch's operation to support the virtual domain and prepares it for the stacking connection. Without this conversion, the switch remains in standalone mode and cannot participate in the virtual domain.

CBWFQ is a class-based scheduling mechanism that builds on per-flow WFQ by classifying packets into user-defined classes, each configured with a minimum bandwidth (as an absolute rate, percentage, or relative weight). When congestion occurs, the scheduler services classes in proportion to their configured weights or bandwidth guarantees, ensuring each class receives its minimum share while still allowing idle classes' bandwidth to be redistributed. This guarantee only applies during congestion; under light load, classes can exceed their configured bandwidth.

MACsec requires MKA to negotiate session keys between peers. If the CAK or key server priority does not match on both ends, MKA will not establish a secure association, and MACsec will not encrypt traffic even though the link is up. Configuring a matching CAK and designating a key server on both switches allows MKA to complete negotiation, after which MACsec encryption begins.

In Ansible's ios_config module, the `parents` parameter specifies the configuration mode to enter before applying `lines`. When `parents` is set to 'router ospf 1', the module already issues that command to navigate into OSPF configuration mode. Adding `router ospf 1` again inside the `lines` list results in a nested command that the Cisco IOS parser does not accept in this context, producing a configuration error. The correct usage is to place only OSPF subcommands, such as network statements, in `lines` and let `parents` handle the mode entry.

When a user attempts authentication, the router consults the method list and sends the request to the first configured RADIUS server, 192.168.1.100. Only if that server times out or is unreachable does the router move to the next server in the list, 192.168.1.101, rather than immediately using local authentication. If all RADIUS servers are unavailable or return errors, the router then falls back to the local database as the final method, so the described behavior is correct.

Traffic always traverses one spine hop, resulting in consistent latency.

A broadcast storm floods every port with endlessly circulating frames, forcing the switch CPU to process enormous volumes of broadcast traffic and replicate frames across the broadcast domain. This software-path processing load, rather than normal hardware switching, is what drives control-plane CPU utilisation upward.

MAB allows non-802.1X-capable devices like printers to be authenticated by their MAC address. The switch learns the MAC address and sends it to ISE as the username and password. ISE can then apply an authorization policy, such as placing the device in a specific VLAN or applying an ACL. This maintains centralized control while supporting legacy devices.

The passive-interface default directive makes every OSPF-enabled interface passive unless a specific interface is later excluded. The no passive-interface GigabitEthernet0/0 command removes that default for Gi0/0, permitting OSPF hello packets and adjacency formation on that link. All other OSPF interfaces remain passive and silent, so only GigabitEthernet0/0 is active in OSPF terms. This precisely matches the configuration, making it the correct answer.

Cisco DNA Center's Plug and Play workflow automatically discovers unconfigured devices, assigns them to sites, and pushes day-zero configurations, removing manual CLI setup. This zero-touch onboarding capability satisfies the statement about PnP support in automation workflows.

NAT-T encapsulates ESP packets inside UDP datagrams on port 4500, allowing them to traverse NAT devices that cannot process ESP or handle PAT for protocol 50. This satisfies the stem's requirement by enabling IPsec traffic through NAT where raw ESP would be dropped.

This access list defines the inside local addresses that will be translated. The wildcard mask 0.0.0.255 matches the entire 192.168.1.0/24 subnet. The access list is then referenced in the ip nat inside source list command to specify which traffic should be translated.

BGP establishes sessions over TCP port 179, so the router must have a valid route to 10.0.0.2 in its IPv4 unicast routing table before attempting the connection. Without that route, packets destined for the neighbor are dropped, the TCP three-way handshake never completes, and the BGP session remains Idle. This would happen even if the neighbor has reachability to this router, because BGP requires bidirectional IP reachability.

In StackWise Virtual, a dual-active detection link is a separate physical connection between the two switches that is used to detect a virtual link failure. When the virtual link fails, the switches use this link to determine which switch should remain active. Configuring this link and enabling dual-active detection prevents both switches from becoming active and causing a split-brain.

EIGRP uses DUAL to maintain a feasible successor for each route. When the only feasible successor for a set of routes fails, EIGRP marks those routes active and sends QUERY packets to all neighbors, which may propagate transitively across the network. The router must wait for every REPLY before computing new routes, and in a large network, this query/reply cycle can easily exceed 15 seconds, causing the observed slow convergence. This active-state process is a classic cause of slow EIGRP convergence.

Enabling port security with switchport port-security, setting the maximum number of MAC addresses, and configuring the violation action to shutdown causes the port to err-disable when the limit is exceeded. This directly meets the requirement to limit MAC addresses per port and shut down on violation. The commands are applied in interface configuration mode.

To mark traffic from a subnet, you must classify it with a class map, define the marking action in a policy map using 'set dscp af31', and attach the policy to the ingress interface with 'service-policy input'. This ensures packets are marked at ingress, and subsequent devices can trust the DSCP if configured to do so.

The command vrrp 1 priority 150 sets the VRRP priority to 150 for group 1 on the interface. A higher priority makes the router more likely to become the master. The default priority is 100, and the range is 1–254. Priority 150 is higher than default, so this router will become master if it is the highest priority in the group. This command is entered in interface configuration mode.

This is the correct command to map a VLAN to a VXLAN VNI on a Cisco Catalyst switch. Under 'vlan configuration 10', the 'vn-segment 10010' command associates VLAN 10 with VNI 10010. This enables the VTEP to encapsulate frames from VLAN 10 into VXLAN packets with VNI 10010, allowing Layer 2 extension across the IP network.

Setting the OSPF priority to 0 on an interface makes that router ineligible to become DR or BDR. This is the correct way to prevent a router from participating in the DR/BDR election. The router will still form adjacencies and exchange routing information, but it will remain a DROTHER. This setting is commonly used on routers that should not be DR/BDR, such as those with lower processing power or at the edge of the network.

LLQ combines CBWFQ with a strict priority queue. It allows VoIP traffic to be placed in a priority queue that is serviced before other queues, ensuring minimal delay and jitter. LLQ is the recommended mechanism for prioritizing real-time traffic like VoIP during congestion.

The EtherChannel has two active member links. The 'P' flag appears on both Gi0/1 and Gi0/2, indicating that exactly two physical interfaces are bundled into the port-channel and are actively forwarding traffic. Since no other ports display the 'P' flag, the EtherChannel is active with two member links. Other ports, such as Gi0/3, show 'D' and are not part of the operational bundle, confirming the two-link count.