ENCOR 350-401 (350-401) — Questions 601–675

The JSON response is an array with exactly one object, and that object contains a management IP address of 10.10.10.1 and a role set to ACCESS. This indicates the Ansible task queried the device inventory and successfully retrieved a single device record. Because the array length is one, there is no ambiguity about multiple devices.

Converged access (SD-Access) wireless is correct because fabric-enabled access points can switch data traffic locally at the access layer rather than tunneling it to a central WLC. The WLC still handles control-plane functions like radio resource management, but user data moves directly toward the fabric edge, which minimizes network delay and jitter for real-time applications. This local switching is exactly what makes SD-Access wireless preferable for a warehouse with latency-sensitive traffic.

The 'dot1x pae authenticator' command configures the switch port to operate as the 802.1X authenticator, meaning it initiates and manages EAP exchanges with the connected client (supplicant). The 'authentication port-control auto' setting explicitly places the port in the unauthorized state initially, allowing only EAPOL traffic to flow. Only after the client successfully authenticates against the configured authentication method (e.g., RADIUS) does the controlled port transition to the authorized state and forward normal data traffic.

ZBFW treats all interfaces in the same zone as a single trust domain, so intra-zone traffic is not inspected and is permitted by default. This design simplifies policy by letting administrators define inspection only for inter-zone flows. In this scenario, if two branch-facing interfaces were both in the VPN zone, traffic between them would bypass inspection, which is a key behavior to understand when designing zone membership.

In OSPF broadcast multiaccess networks, the DR/BDR election is governed by the interface priority field, which ranges from 0 to 255. Setting a priority of 0 explicitly marks the router as ineligible to participate in the election, so it can never be selected as the DR or BDR, regardless of its Router ID or any other factor. The router remains fully operational as a DROther and still establishes adjacencies with the DR and BDR.

Template Editor is DNA Center's dedicated tool for authoring CLI templates with variables, then binding them to devices during provisioning. Since discovery and Inventory are complete, this satisfies the consistency requirement by applying the same configuration template across the new branch devices.

When interfaces are grouped into an EtherChannel, the software creates a single logical port-channel interface that represents the entire bundle. STP treats this logical port-channel as the spanning-tree port, and per-interface STP parameters on the physical member links are effectively overridden and ignored. The member interfaces are not independent STP ports; they are just physical paths within the aggregated link. Therefore, PortFast configured on the members has no effect on the STP state of the EtherChannel, making this statement correct.

In a high-density wireless design, co-channel interference is the primary limiting factor because all APs on the same channel share the medium. A channel reuse plan ensures that APs operating on the same non-overlapping channel are separated by enough physical distance, often using different channels for adjacent cells. This spatial reuse maximizes aggregate throughput by allowing more simultaneous transmissions.

Ansible is an agentless automation tool that uses SSH to connect to managed devices. It uses YAML-based playbooks, which match the engineer's preference. For Cisco IOS XE, Ansible provides modules like ios_config and ios_command that run over SSH. This makes Ansible the ideal choice for simple, agentless configuration management with YAML playbooks.

This sequence enters interface configuration mode, sets the port to access mode, and assigns it to VLAN 20. The switchport mode access command ensures the port operates as an access port, and switchport access vlan 20 places it in the correct VLAN. This is the standard method to configure an access port on a Cisco Catalyst switch.

The BGP EVPN address family carries MAC and IP address reachability information in the form of EVPN routes, such as Type 2 and Type 5 routes. This allows VTEPs to learn about remote hosts and VTEPs, facilitating the creation of VXLAN tunnels and enabling efficient forwarding without flooding.

The :candidate capability indicates support for a candidate configuration datastore, which allows changes to be staged and validated before being committed to the running configuration. Without this capability, the router cannot accept edits to a candidate datastore, resulting in the error. Enabling :candidate enables the desired workflow of testing configurations before applying them.

Cisco ISE is the policy engine that assigns SGTs to users and devices during authentication. It also defines security group ACLs (SGACLs) that determine what traffic is permitted between groups. Without ISE, dynamic SGT assignment and centralized policy management are not possible, making it a fundamental component of CTS.

The 'vlan 200' command in global configuration mode creates VLAN 200 and enters VLAN configuration mode. This is the correct way to create a VLAN on a Cisco Catalyst switch. After entering this command, the VLAN is active by default unless it is shutdown. This command is essential for adding a new VLAN to the switch's VLAN database.

This is correct because the output of `show policy-map interface` displays all class counters as zero, including classifications, bytes, and drops. A zero packet count across every class indicates that no packets have been classified or forwarded on this interface since the policy was attached. Therefore, the interface is not passing any traffic at all.

The output confirms Port-channel1 is in trunking mode, is operationally up, and its allowed VLAN list matches the configured VLANs of 1-100 and 200-300. The 'show interfaces trunk' command verifies that the port-channel is carrying traffic for the exact set of VLANs that were configured, with no unexpected additions or removals. This matches the correct operational state expected for a properly configured EtherChannel trunk.

The 'logging trap 4' command sets the syslog severity level for messages sent to the syslog server to level 4 (warnings). This means only messages with severity 4 and higher (0-4) will be sent, which matches the requirement. It is the correct command to limit syslog messages to the specified severity.

This configuration enters VLAN 10 SVI, assigns the physical IP 10.10.10.2, then enables VRRP group 10 with virtual IP 10.10.10.1 and priority 110. In VRRP, the highest priority becomes the master; 110 exceeds the default 100, making this switch the master. The syntax matches Cisco IOS VRRP commands exactly.

R1's interface shows 2WAY/DROTHER with neighbour 10.0.0.3, and FULL/DR with 10.0.0.2, meaning R1 formed full adjacency only with the DR. On a broadcast segment, DROTHERs stay in 2WAY with each other, so R1 itself is a DROTHER, not the DR or BDR.

The <get-config> operation is designed to retrieve configuration data from a specified datastore, such as <running/>. It returns the configuration in XML format. This is the correct NETCONF operation for reading configuration, as it does not include state data. The engineer can then parse the XML to extract the running configuration.

The ISO installation image is mounted as a virtual CD-ROM; if the VM's boot order does not list the CD-ROM first, the firmware will pivot to the empty virtual hard disk. Since that disk has no boot loader and no installed NFVIS image, the firmware reports 'no bootable device'. Changing the boot order to prioritize the CD-ROM (or virtual media) lets the installer start and deploy the WAN edge image to the disk.

The timeout counter shows exactly 1, meaning one request was transmitted but no response was received within the configured timeout period. Since 10 packets were sent and only 9 were received, the single mismatch between sent and received is precisely accounted for by this timeout. This is a normal transient condition, such as a dropped packet or a slow server response, not a systemic failure.

With ansible_connection: network_cli, Ansible must be told to escalate privileges by setting ansible_become: yes and ansible_become_method: enable. If the become method is omitted, the automation engine has no way to issue the enable command, so IOS remains at the user EXEC prompt and Ansible times out waiting for a privileged prompt that never arrives. The ios_command tasks then fail with a 'timeout waiting for privilege escalation prompt' error instead of returning command output.

This is a targeted LDP session because the discovery source is a 'Targeted Hello,' which is used to establish LDP peering between routers that are not directly connected. Targeted hellos are unicast to a configured neighbor's IP address, enabling the LDP peers to form a TCP session and exchange labels even across multiple hops. The output confirms this by showing the discovery source as targeted, and the session state is operational, indicating an established targeted LDP session.

The default quiet-period in Cisco 802.1X is 60 seconds. This timer is triggered after an authentication failure, placing the switch port in a quiet state during which EAPOL requests from the supplicant are ignored. The 60-second default balances security against usability, preventing rapid brute-force attempts while still giving users a reasonable chance to retry.

The fabric edge node provides the layer 3 gateway and policy enforcement for endpoints in the SD-Access fabric. It encapsulates traffic using VXLAN and registers endpoints with the control plane node. In a branch with minimal IT staff, the edge node enables automated onboarding and consistent policy from Cisco DNA Center, exactly as required.

The root cause is that CBWFQ's percent-based bandwidth commands (bandwidth percent, priority percent) are calculated against the interface `bandwidth` setting, not the physical line rate. If an Ethernet interface retains its default bandwidth of 1000000 kbps (1 Gbps) while the actual WAN circuit is 50 Mbps, a voice class configured with `bandwidth percent 10` would reserve 100000 kbps instead of 5000 kbps. Without `bandwidth 50000` under the interface, the percentages do not map to the real link speed, so the voice class appears under-allocated even though the configuration is logically correct.

The SGT is a 16-bit value inserted into the frame or packet at the ingress device, which then enforces policy at egress based on the tag instead of IP. Propagation via inline tagging or the SGT Exchange Protocol (SXP) keeps role identity intact across VLAN and subnet boundaries, which is exactly what the security team requires.

With 'switchport mode trunk' and 'switchport trunk encapsulation dot1q', the interface inserts a 4-byte 802.1Q tag for frames on all VLANs except the native VLAN. Because the default native VLAN is VLAN 1, any untagged frame received on the trunk is classified as belonging to VLAN 1 and forwarded accordingly. This is the standard behavior for a dot1q trunk unless the native VLAN is explicitly changed with 'switchport trunk native vlan'.

Fabric edge nodes are responsible for encapsulating endpoint traffic into VXLAN and forwarding it to the border. They act as VTEPs, mapping endpoint IP addresses to fabric locators and tunneling traffic across the underlay. This design provides policy enforcement and segmentation, ensuring that employee traffic destined for external networks is properly encapsulated and sent to the border for routing.

The global configuration command 'vrf definition TENANT_A' creates a VRF instance named TENANT_A and enters VRF configuration mode. This command is used on Cisco IOS-XE routers to define a VRF, which provides separate routing and forwarding tables for each tenant. Within VRF configuration mode, the engineer can configure route distinguishers (RD) and route targets (RT) to control route import and export. This command is essential for enabling VRF-lite or MPLS Layer 3 VPNs, allowing overlapping IP addresses across tenants.

vSmart is the centralized control plane component of Cisco SD-WAN. It distributes routing information, policies, and keys to the WAN Edge devices. It uses Overlay Management Protocol (OMP) to exchange routes and policies, enabling dynamic path selection based on application policies. This matches the requirement for centralized control plane functions.

Type 1 hypervisors, also known as bare-metal hypervisors, run directly on the host hardware without an underlying operating system; the hypervisor itself acts as the resource manager and scheduler. Type 2 hypervisors, by contrast, are applications installed on top of a general-purpose host OS, which mediates all hardware access. This fundamental split drives most other differences in performance, security, and management.

ISE matches MAB requests against endpoint MAC addresses in its database using a specific format. If the endpoint was added with a different delimiter or case than what the switch sends in the Calling-Station-Id, ISE will not match the identity group and will reject the request, causing the unauthorized state.

A classic site-to-site IPsec VPN on Cisco IOS requires an extended ACL to identify interesting traffic, an ISAKMP (IKE) policy to define Phase 1 parameters, a preshared key for peer authentication, and a crypto map that references the ACL and transform set and is applied to the WAN interface. Together these elements establish and encrypt the tunnel.

The src-dst-ip method hashes both the source and destination IP addresses together to select an egress link. When every packet between two IP endpoints is going between the same pair, the hash output is identical for each packet, so the deterministic hash always maps to the same member port. This is exactly the condition that forces all traffic onto a single link, even if multiple flows exist between those IPs.

The show interfaces trunk command displays the trunk interfaces, their mode, encapsulation, and the native VLAN. It explicitly lists the native VLAN in the output, allowing the administrator to quickly verify if it matches on both ends. This is the most direct command to check the native VLAN configuration on a trunk port.

Ansible is an agentless automation tool that uses SSH or NETCONF to connect to devices, requiring no agent installation on managed nodes. It uses declarative playbooks written in YAML. This aligns perfectly with the requirement for an agentless, declarative tool run from a central server. Ansible is widely used for Cisco network automation.

In Cisco ACI, the Policy Enforcement Point (PEP) is responsible for enforcing contracts between EPGs. The PEP is typically implemented in the leaf switches, where it applies filters and actions defined in the contract. This ensures that traffic is permitted or denied based on the contract, meeting the security requirement.

This sequence enters interface configuration mode, sets the port to access mode, and assigns VLAN 20. It is the correct and standard method to configure an access port on a Cisco Catalyst switch. The port will carry untagged traffic for VLAN 20, and any existing VLAN 1 assignment is overridden.

The allowed list spans 1-1005, but the active management domain shows only 1, 10 and 20, proving VLANs 2-9 exist in the allowed range yet carry no active ports. Spanning-tree forwarding state confirms the same set, so those VLANs are permitted but dormant.

Creating separate class-maps allows the engineer to apply distinct policers to each traffic type. By giving SSH a higher rate limit or configuring it to always transmit, management access is protected. OSPF and BGP can be rate-limited independently to prevent control plane overload. This granular approach is the recommended CoPP design for protecting critical management traffic.

This is the definition of traffic shaping. The 'shape average 1000000' command configures a token bucket that allows bursts up to the committed burst size, but the average transmit rate is capped at 1 Mbps. When traffic exceeds this rate, excess packets are buffered in the shaping queue rather than dropped (unless the queue overflows and tail drop occurs). This smoothing of traffic avoids packet loss and is appropriate for interfaces that can tolerate delay but need to conform to a subscribed rate.

Strict Unicast Reverse Path Forwarding validates the source address of a packet by performing a reverse lookup in the FIB. If the best route to the source IP is not via the same interface that received the packet, the router drops it. This prevents spoofed traffic where an attacker sends packets with a source address that would legitimately arrive on a different interface, ensuring asymmetric routing paths or forged addresses are rejected.

This is correct because the ACL's logic is explicit: entries 10 and 20 only match ICMP echo requests and echo replies sourced from 10.1.1.1. A final explicit deny entry (entry 30) then catches every other ICMP packet, regardless of its type or destination, and drops it. Thus, any ICMP packet with a source address different from 10.1.1.1 is denied, which makes the statement accurate.

Route reflection removes the iBGP full-mesh requirement: the reflector re-advertises routes learned from one client to other clients and non-clients. This directly satisfies the scalability constraint of avoiding a full mesh between all iBGP speakers.

This command sets the port's authentication mode to auto, meaning the port will be unauthorized until the client successfully authenticates via 802.1X. It triggers the authentication process and is the required command to enable 802.1X on an interface. This is the correct answer because it directly controls the port's state based on authentication.

The command 'cache entries' (Cisco IOS command 'ip flow-cache entries' or 'flow-cache entries' under the flow exporter) defines the maximum number of flow records that can be held concurrently in the flow cache. The value 16,000 is the default or configured limit for the number of flow entries, each of which is a structure containing fields such as source/destination IP, source/destination port, protocol, and byte/packet counters. When this limit is reached, new flows trigger eviction of existing entries (usually the oldest or least active) to make room, but the configured size itself does not change automatically.

Shutdown mode causes the port to go into an error-disabled state immediately upon a violation, sends an SNMP trap, and increments the violation counter. This exactly matches the stated security policy. The port must be manually re-enabled with a shutdown/no shutdown sequence after the violation is resolved.

Every OSPF router originates a Type 1 Router LSA describing its own links, interface states and costs, flooded only within its area. This satisfies the requirement that each router advertises its local topology, forming the basis of the area's shortest-path tree.

The fabric control plane node, which runs LISP map-server and map-resolver functions, maintains the database of endpoint IP addresses and their associated fabric edge nodes. It provides the mapping service that allows fabric edge nodes to locate endpoints and establish optimal forwarding paths, making it essential for large-scale SD-Access deployments.

Isolating storage on its own vSwitch with a 9000 MTU and dedicated uplinks on the storage VLAN separates the traffic from management and VM flows while enabling jumbo frames end to end. The storage VMkernel adapter carries the HyperFlex data traffic, and the dedicated uplinks ensure the storage VLAN is not shared with other traffic types. This matches HyperFlex networking requirements.

With the collector enabled and the switch configured, the remaining variable is transport. Syslog uses UDP 514, so an intervening firewall or ACL silently dropping that traffic would explain why DNA Center receives nothing despite correct endpoint configuration.

In 802.11r fast roaming, the over-the-DS mode enables key exchange between the client and target AP via the distribution system (usually the wired network), rather than directly over the air. This reduces roaming latency because the target AP's key is provided before the client reassociates. The command in question specifically turns on this behavior, making this the correct answer.

Enabling IP routing on the Cisco CSR 1000v allows it to route traffic between different VLANs. By default, routing may be disabled. Once enabled with the 'ip routing' command, the router can forward packets between subnets, including those on different VLANs, provided interfaces are configured correctly.

Cisco DNA Center's Intent API uses token-based authentication. After authenticating via /dna/system/api/v1/auth/token, the script must include the returned token in the X-Auth-Token header for subsequent requests. Without this header, the server returns 403 Forbidden even if credentials are correct. The script likely omitted this step, causing the authorization failure.

This is the correct configuration. The command 'switchport mode trunk' forces the interface into permanent 802.1Q trunking mode, independent of DTP negotiation. Adding 'switchport trunk native vlan 100' correctly changes the native VLAN assignment from the default VLAN 1 to VLAN 100, so untagged traffic on this trunk is interpreted as belonging to VLAN 100. This combination reliably establishes a trunk with the desired native VLAN.

Setting hosts: core in the play header is the most direct, idempotent way to restrict execution to only those switches that belong to the 'core' inventory group. The hosts field accepts an inventory pattern or group name, and Ansible evaluates the pattern before the play starts, so no hosts outside the group are even considered for connection. This is the standard Ansible playbook design feature for targeting a subset of managed nodes.

CPU pinning binds the VM's vCPUs to specific physical cores, preventing other VMs from scheduling on those pCPUs and eliminating runqueue contention. Memory reservation guarantees that the hypervisor always allocates the VM's required memory from physical RAM, so the VM never suffers from ballooning or swapping. Together these provide deterministic CPU and memory access, directly mitigating the jitter and latency caused by noisy neighbors.

This configuration enables OSPF MD5 authentication on the interface and defines the key with ID 1 and password 'Cisco123'. The 'ip ospf authentication message-digest' command activates MD5 authentication for OSPF on that interface, and the 'ip ospf message-digest-key' command specifies the key. This is the correct method to configure MD5 authentication on a per-interface basis in Cisco IOS.

This statement is correct, but the nuance is that when the active timeout (configured with 'ip flow-cache timeout active 60') expires, the flow is exported immediately to the collector, yet if the flow is still in progress, NetFlow creates a new cache entry to track the continuation of the same session. This prevents long-lived flows (e.g., large file transfers) from being invisible until they end, providing periodic accounting updates. The original cache entry is indeed removed after export, but the flow's data is not lost; it is continued in the new entry with a fresh start time.

In DNA Center, CLI templates are created and then associated with a site, and devices that are not assigned to a site cannot be targeted by the provisioning workflow that applies those templates. Template configuration via the 'Provision' workflow only operates on devices that belong to a selected site in the network hierarchy. Thus the correct fix is to assign the switch to a site, after which the templates and compliance checks become applicable.

StackWise-480 uses a ring topology in which each switch connects to the next and the final switch connects back to the first. This loop allows traffic to flow in either direction, so a single cable or switch failure does not split the stack. That matches the requirement for a resilient stack ring.