ENCOR 350-401 (350-401) — Questions 526–600

Docker is orchestrated by Docker Swarm or Kubernetes, but Kubernetes is the primary orchestrator; LXC/LXD is orchestrated by LXD; containerd is often used with Kubernetes; rkt was orchestrated by Kubernetes; and OpenVZ is managed by Proxmox VE.

Permit allows traffic, deny drops traffic, remark adds a comment, log records matches, and established matches TCP with ACK/RST set.

The correct order starts with configuring the subscription on the device, then specifying the data nodes, setting the update policy, and finally the device starts sending updates based on the policy.

Active initiates negotiation, passive waits for partner.

The MQC process first defines traffic classes with class maps, then associates actions with policy maps, and finally applies the policy to an interface with a service-policy statement. Verification ensures correct operation.

Cisco 9800 WLCs have CAPWAP control path DTLS encryption enabled by default to secure control plane communications between the WLC and APs. This is mandated by RFC 5415 and ensures integrity and confidentiality of management traffic such as configuration and keepalives. The default setting cannot be disabled globally; it is always active for control traffic.

SNMPv1 and v2c use community strings (plaintext) for authentication; SNMPv3 provides authentication and encryption.

Emergency=0, Alert=1, Critical=2, Error=3, Warning=4, Notice=5, Informational=6, Debug=7.

A 400 Bad Request typically indicates a malformed request, such as missing required parameters. The API documentation specifies that 'siteId' is required, so the engineer must include it as a query parameter in the request.

Port SPAN monitors all traffic on a specific port; VLAN SPAN monitors all traffic in a VLAN; EtherChannel SPAN monitors all traffic on a port-channel interface.

In a multi-access network running PIM, the Designated Router (DR) is responsible for forwarding multicast traffic onto the segment. If both routers have the same DR priority (default 1) and the DR election has not completed or is tied, both may forward traffic, causing duplication. The DR election uses the highest IP address as a tiebreaker when priorities are equal, but if the election process is incomplete or both routers believe they are the DR, duplication occurs.

Correct pairings: get retrieves running config and state data; get-config retrieves a specific datastore; edit-config modifies configuration; commit confirms a candidate configuration; lock prevents other sessions from modifying a datastore.

First enable the dot1q tunnel globally, then configure the access VLAN on the interface, enable the tunnel mode, and set the native VLAN to avoid conflicts.

VMware vSphere is from VMware, KVM is from Red Hat (open source, but Red Hat is the primary commercial backer), Microsoft Hyper-V is from Microsoft, Xen is from Citrix (originally from the Xen Project), and Oracle VM is from Oracle.

The 2800/3800 series APs are 802.11ac Wave 2 devices that support MU-MIMO and have integrated antennas; they do not support 802.11ax (Wi-Fi 6) and are not modular with field-replaceable radios.

VTP pruning must be enabled globally before configuring the pruning-eligible list on a specific trunk interface. The global VTP pruning command enables the feature, then per-interface configuration restricts which VLANs can be pruned.

The process starts with identifying the YANG module, then navigating the tree to the interface container, retrieving statistics, and optionally filtering or using NETCONF/RESTCONF.

STP (802.1D) is the original slow-converging standard; RSTP (802.1w) provides rapid convergence; MSTP (802.1s) maps multiple VLANs to fewer spanning tree instances; PVST+ runs per-VLAN STP. Common confusions include equating STP with per-VLAN and RSTP with multiple instances.

The response shows the statistics for the interface, including in-octets and out-octets. The data is in JSON format with the namespace prefix 'ietf-interfaces:'. The engineer can use this data to monitor interface utilization.

Import RT adds routes with matching RT into the VRF; export RT tags routes from the VRF; import map filters routes during import; export map filters routes during export; both import and export can be configured per VRF.

OpenConfig defines vendor-neutral models, Cisco-IOS-XE-native defines Cisco-specific native models, and ietf-interfaces defines standard interface models.

Higher weight is preferred; higher LOCAL_PREF is preferred; shorter AS_PATH length is preferred; lower MULTI_EXIT_DISC is preferred; lower IGP metric to next-hop is preferred.

CE routers connect customer sites to the provider; PE routers label customer routes and exchange VPNv4 prefixes via MP-BGP; P routers perform label switching without storing customer routes; ASBR routers connect different MPLS domains; RRs propagate VPN routes within an AS.

Cold migration requires the virtual machine to be powered off before moving to a different host (B is correct). Storage vMotion migrates disk files between datastores while the VM remains running (C is correct). vMotion does not always require shared storage; modern implementations allow migration without it (D is incorrect). vMotion has minimal downtime but not zero, so A is false. Cold migration can move VMs across datacenters within the same vCenter, so E is false.

get retrieves operational state and configuration, get-config retrieves only configuration, edit-config modifies configuration, commit applies candidate changes, and lock prevents other sessions from modifying the datastore.

PIM Sparse Mode uses explicit join to build shared tree then optionally switch to SPT; PIM Dense Mode floods and prunes; PIM SSM uses exclusively source-specific trees; PIM Bidir uses a shared tree with no source-specific tree and a designated forwarder to prevent loops.

Routing class protects control plane routing protocols; Management class allows SSH/SNMP; Exception class handles packets that need CPU processing (e.g., TTL expiry); Default class matches all other traffic; Critical class is for high-priority control traffic.

extra-vars have highest precedence; role defaults have lowest; host vars apply to a specific host; group vars apply to all hosts in a group; play vars are set at the play level.

The collector initiates the connection, authenticates, requests data, and the device streams telemetry back until the session ends.

Inventory defines managed nodes; playbook is a YAML file of tasks; role is a reusable set of tasks; module is a Python script for a specific action; handler is a task triggered by a notify.

Ansible roles follow a standard directory layout: tasks/main.yml is executed first, then handlers are notified, defaults provide variables, vars override defaults, and templates are rendered for configuration files.

The audit starts with inventory collection, then performance baselining. Security and configuration compliance are checked, gaps are identified, and finally a remediation plan is created.

In MPLS L3VPN on Cisco IOS-XR, simply configuring the VRF and establishing the BGP VPNv4 session is insufficient. The engineer must explicitly configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and use the redistribute command (e.g., redistribute connected or redistribute static) to inject the VRF routes into BGP for advertisement to the route reflector. Without this, the VRF routes remain in the local routing table but are never converted into VPNv4 prefixes.

The candidate datastore flow begins with locking the candidate, then editing it, validating the changes, committing them to running, and finally unlocking the candidate.

The script uses netmiko's `send_command()` method, which sends a show command to the device and returns the output. It does not include any configuration commands or file transfer operations. Therefore, its primary purpose is to retrieve and print the output of 'show ip interface brief'.

MSDP peers first establish a TCP connection, then exchange SA messages to advertise active sources; the remote RP receives the SA, creates (S,G) state, and forwards join toward the source.

The correct order begins with creating the template in the project, then committing the template, then attaching it to a site, then provisioning the device, and finally pushing the configuration. This ensures the template is properly versioned and applied during provisioning.

L3VPN uses IP routing (Layer 3) and VRF, L2VPN emulates Layer 2 services like Ethernet, VPLS is a multipoint L2VPN, VPWS is a point-to-point L2VPN, and EVPN is a modern L2VPN control plane.

DNA Center Assurance provides proactive monitoring and troubleshooting. The correct answers cover its data sources (NetFlow, SNMP, syslog), client health scoring, and AI-driven insights. The wrong answers incorrectly claim real-time packet capture (not a core Assurance feature) and that Assurance only monitors wired clients.

When subinterfaces are moved into a VRF, the CEF table for that VRF will contain the learned prefixes, but the next-hop addresses must also be reachable within the same VRF. If the next-hop IP addresses reside in the global routing table instead of the VRF, the VRF will have no route to those next hops, causing them to be marked as unreachable. This is a common misconfiguration where the next-hop adjacency is not established within the VRF context.

MAB is used as a fallback when 802.1X fails; the switch detects the MAC, sends a RADIUS Access-Request, ISE checks the MAC database, returns an Access-Accept with a downloadable ACL, and the switch applies the ACL.

Policy creation begins with defining the policy in vManage, then attaching it to a group of devices, after which vManage pushes the policy to vSmart, vSmart translates it into OMP updates, and finally the edge devices receive and enforce the policy.

The 'merged' state adds the provided configuration to the existing configuration without removing any other settings. If the interface already has an IP address, it will be replaced only if the address is different; otherwise, it remains unchanged.

In hub-and-spoke EIGRP, the spoke router is configured as a stub to limit query propagation. First, enter router configuration mode, then enable EIGRP on the spoke, configure it as a stub, optionally restrict advertised routes, and finally verify the stub status.

Voice traffic requires strict priority to ensure minimal jitter and latency. DSCP EF (Expedited Forwarding, per RFC 3246) is the standard marking for real-time traffic like voice, and placing it in a strict priority queue (LLQ) guarantees that voice packets are serviced before any other queue, which is essential for meeting QoS requirements in a DiffServ model.

The correct order begins with retrieving the OpenAPI specification from DNA Center, then parsing the endpoint definition, validating the request parameters against the schema, checking the response structure, and finally confirming compliance with the API contract.

DNA Center provides proactive health monitoring, client troubleshooting via historical data, and sensor-based proactive testing. It does not replace the WLC for real-time client association, nor does it require a separate controller for assurance data.

Hello timer defaults to 2 seconds; Forward delay defaults to 15 seconds; Max age defaults to 20 seconds.

A centralized data policy in Cisco SD-WAN must include match conditions for both the VPN (service-side VRF) and the site list to which the policy applies. Without specifying the correct VPN or site list, the policy may be received and active on the vEdge but will not match the traffic flows, causing them to fall through to the default routing behavior (e.g., MPLS). The policy matches destination IPs, but if the VPN or site scope is missing or incorrect, the vEdge will not apply the policy to the relevant traffic.

The provisioning process starts with defining the VM XML, then starting it, installing the OS, and finally accessing the console.

The script uses Netmiko's `send_config_set()` method to push a list of configuration commands to the device. The commands configure interface GigabitEthernet1/0/1 with a description, assign an IP address, and issue `no shutdown` to enable the interface. This matches option B exactly.

BSR messages are flooded hop-by-hop using PIM. If PIM is not enabled on all interfaces between the BSR and the other routers, the BSR messages will not be forwarded, preventing RP discovery.

Deploying a virtual router VNF starts with uploading the image, then creating the VM, attaching virtual interfaces, configuring routing protocols, and finally verifying connectivity.