Implementing and Operating Cisco Enterprise Network Core Technologies (350-401 ENCOR) — Questions and Answers

Question 1: What does the term 'southbound API' refer to in SDN architecture?

APIs used by the controller to communicate with and program network devices (Correct answer)
APIs for external monitoring systems
APIs between peer controllers
APIs used by applications to request network services from the controller

Correct answer: APIs used by the controller to communicate with and program network devices

Southbound APIs (e.g., OpenFlow, NETCONF) are used by the SDN controller to communicate with and configure the underlying network infrastructure.

Question 2: What is the primary function of the Cisco IOS 'ip flow-export' command in a NetFlow deployment?

Captures packet payloads for deep inspection
Enables SNMP traps on interface statistics
Configures IPFIX sampling rate
Sends cached flow records to a NetFlow collector (Correct answer)

Correct answer: Sends cached flow records to a NetFlow collector

The ip flow-export command specifies the destination IP, UDP port, and NetFlow version for exporting flow cache records to an external collector.

Question 3: Which encoding format is human-readable, uses indentation for structure, and is commonly used in Ansible playbooks?

YAML (Correct answer)
XML
CSV
JSON

Correct answer: YAML

YAML (YAML Ain't Markup Language) uses indentation and a clean syntax that is highly readable, making it the format used for Ansible playbooks.

Question 4: Which multicast address does VXLAN use for BUM traffic when flooding is enabled?

239.x.x.x (configured multicast group) (Correct answer)
255.255.255.255
224.0.0.5
224.0.0.1

Correct answer: 239.x.x.x (configured multicast group)

VXLAN BUM (Broadcast, Unknown-unicast, Multicast) traffic uses a configured multicast group address in the 239.x.x.x range.

Question 5: What is the role of YANG in network automation?

A Python library for network automation
An encoding format like JSON or XML
A data modeling language used to define the structure of network configuration and state data (Correct answer)
A transport protocol for configuration data

Correct answer: A data modeling language used to define the structure of network configuration and state data

YANG (RFC 6020/7950) is a data modeling language used to define the data hierarchy and constraints for NETCONF/RESTCONF operations.

Question 6: In an MPLS network, what does the term 'LSP' stand for?

Label Switching Protocol
Label Stack Pointer
Label Switched Path (Correct answer)
Link State Propagation

Correct answer: Label Switched Path

LSP stands for Label Switched Path, which is the unidirectional path from ingress to egress LSR that packets follow.

Question 7: In Cisco DNA Center, which intent-based networking workflow automates the provisioning of network devices according to predefined design templates?

Provision (Correct answer)
Design
Policy
Assurance

Correct answer: Provision

The Provision workflow in DNA Center deploys network profiles and templates to devices, automating day-0 and day-1 configuration based on the Design and Policy settings.

Question 8: What is the purpose of the BGP 'next-hop-self' command on a route reflector?

Changes the AS path for outbound routes
Enables BGP fast convergence
Disables BGP split horizon
Forces iBGP peers to use the route reflector as the next-hop (Correct answer)

Correct answer: Forces iBGP peers to use the route reflector as the next-hop

The next-hop-self command causes the router to replace the BGP next-hop attribute with its own address, ensuring iBGP peers can reach destinations through it.

Question 9: What is the purpose of a Route Distinguisher (RD) in MPLS L3VPN?

Controls which routes are imported into a VRF
Defines the MPLS label range per VPN
Encrypts VPN routes between PE routers
Makes overlapping customer IP prefixes unique in the BGP table (Correct answer)

Correct answer: Makes overlapping customer IP prefixes unique in the BGP table

The RD is prepended to customer prefixes to create unique VPNv4 routes, allowing overlapping IP space from different customers to coexist in the BGP table.

Question 10: In a VSS (Virtual Switching System) deployment, what is the primary benefit over a traditional dual-supervisor chassis?

Spanning Tree is required between the VSS peers
Doubled forwarding table size only
Two physical switches appear as a single logical switch, enabling active-active forwarding (Correct answer)
VSS is supported on all Catalyst platforms

Correct answer: Two physical switches appear as a single logical switch, enabling active-active forwarding

VSS pairs two physical chassis into one logical switch, enabling active-active data forwarding across both chassis and eliminating the need for STP between the pair.

Question 11: What OSPF router type connects one or more areas to the OSPF backbone (Area 0)?

Internal Router
Area Border Router (ABR) (Correct answer)
Autonomous System Boundary Router (ASBR)
Backbone Router

Correct answer: Area Border Router (ABR)

An ABR (Area Border Router) connects one or more OSPF areas to backbone Area 0 and maintains separate LSDBs for each area it belongs to.

Question 12: Which MPLS label operation replaces an existing label with a new label?

Merge
Swap (Correct answer)
Push
Pop

Correct answer: Swap

The Swap operation replaces the top label in the MPLS stack with a new label at each transit LSR.

Question 13: A Cisco switch is extremely secure out of the box by design because it.

Turns on vty and console password so that secured remote session from SSH and Telnet can be made
Only allows console access (Correct answer)
Only allows remote access from a secured location
Disables all physical and remote access and users have to call Cisco Technical Assistance Center (TAC) to activate the switch first

Correct answer: Only allows console access

Out of the box, a new Cisco switch is designed with security in mind by only allowing console access. It typically has no IP address configured and no remote access protocols like Telnet or SSH enabled or secured. This ensures that an administrator must physically connect to the device via the console port to perform initial setup and configure network access and security.

Question 14: Which protocol is used as the data plane encapsulation in VXLAN overlays?

UDP (Correct answer)
TCP
ESP
GRE

Correct answer: UDP

VXLAN encapsulates Layer 2 frames inside UDP packets, using destination port 4789 by default.

Question 15: What is the primary role of a VTEP in a VXLAN network?

Assign VNIs to hosts
Route between VXLANs
Encapsulate and decapsulate VXLAN packets (Correct answer)
Provide DHCP to overlay hosts

Correct answer: Encapsulate and decapsulate VXLAN packets

A VXLAN Tunnel Endpoint (VTEP) performs the encapsulation of Layer 2 frames into VXLAN/UDP and the reverse decapsulation.

Question 16: What is the purpose of Dynamic ARP Inspection (DAI)?

Rate-limit ARP traffic
Block ARP broadcasts
Encrypt ARP replies
Prevent ARP spoofing by validating ARP packets against the DHCP snooping binding table (Correct answer)

Correct answer: Prevent ARP spoofing by validating ARP packets against the DHCP snooping binding table

DAI validates ARP packets by checking the IP-to-MAC binding against the DHCP Snooping table, preventing ARP poisoning attacks.

Question 17: Which type of Cisco DNA Center intent API allows you to retrieve the list of all network devices in the fabric?

Tag API
Path Trace API
Site Hierarchy API
Network Device API (Correct answer)

Correct answer: Network Device API

The Network Device API (`/dna/intent/api/v1/network-device`) returns inventory information for all devices managed by Cisco DNA Center.

Question 18: Which Cisco SD-WAN feature allows traffic to be steered based on application-aware policies?

PBR
IP SLA
WCCP
Application-Aware Routing (AAR) (Correct answer)

Correct answer: Application-Aware Routing (AAR)

Application-Aware Routing (AAR) in Cisco SD-WAN dynamically routes traffic based on application type and real-time link performance metrics.

Question 19: What is the function of the LISP ITR (Ingress Tunnel Router) in a LISP deployment?

Responds to LISP map requests from remote sites
Encapsulates packets from EID space toward RLOC destinations (Correct answer)
Stores the full EID-to-RLOC mapping database
Decapsulates LISP-encapsulated packets arriving from the core

Correct answer: Encapsulates packets from EID space toward RLOC destinations

The ITR encapsulates packets sourced from the EID (Endpoint ID) address space and forwards them through the LISP tunnel toward the RLOC (Routing Locator) of the destination XETR.

Question 20: Which header field uniquely identifies a VXLAN segment and is carried in the VXLAN header?

MPLS label
GRE key
VLAN tag
VNI (VXLAN Network Identifier) (Correct answer)

Correct answer: VNI (VXLAN Network Identifier)

The 24-bit VNI in the VXLAN header identifies the individual virtual network segment.

Question 21: Which Cisco feature automatically shuts down a switchport when a BPDU is received on a PortFast-enabled port?

Root Guard
BPDU Guard (Correct answer)
UDLD
Loop Guard

Correct answer: BPDU Guard

BPDU Guard disables a PortFast-enabled port upon receiving a BPDU, protecting the STP topology from unauthorized switches.

Question 22: In Cisco SD-WAN (Viptela), which component distributes OMP routing updates between vEdge/cEdge routers?

vSmart (Correct answer)
vAnalytics
vBond
vManage

Correct answer: vSmart

The vSmart controller runs OMP (Overlay Management Protocol) and acts as the route reflector for all SD-WAN edge devices.

Question 23: In a Cisco ACI fabric, what is the function of the APIC (Application Policy Infrastructure Controller)?

It forwards all data-plane traffic between leaf switches
It performs hardware-based packet forwarding in the spine layer
It acts as the centralized policy manager and REST API endpoint for the fabric (Correct answer)
It provides DHCP services to connected endpoints

Correct answer: It acts as the centralized policy manager and REST API endpoint for the fabric

The APIC is the centralized automation and policy management controller for ACI, providing a REST API interface but not participating in data-plane forwarding.

Question 24: To connect to the Cisco switch, you would utilize a _______ cable.

UTP rolled cable (Correct answer)
RJ-48 straight through
RJ-45 Ethernet
RJ-45 crossover

Correct answer: UTP rolled cable

A UTP rolled cable, commonly known as a rollover or console cable, is specifically used to connect a computer's serial port (or a USB-to-serial adapter) to the console port of a Cisco switch or router. This cable allows direct, out-of-band access to the device's Command Line Interface (CLI) for initial configuration and troubleshooting. It has a specific pinout that "rolls over" the transmit and receive pins.

Question 25: Which Git concept allows developers to work on features independently without affecting the main codebase?

Merge conflict
Branch (Correct answer)
Commit
Tag

Correct answer: Branch

Git branches create independent lines of development, allowing features or fixes to be developed in isolation before merging.

Question 26: In LISP, which device answers Map-Request queries by providing EID-to-RLOC mappings?

ETR
PxTR
ITR
MS/MR (Correct answer)

Correct answer: MS/MR

The Map Server (MS) and Map Resolver (MR) store and resolve EID-to-RLOC mappings in the LISP control plane.

Question 27: What is the MPLS EXP (experimental) field in a label entry now officially renamed to in RFC 5462?

CoS bits
Priority bits
DiffServ Code Point (DSCP)
Traffic Class (TC) bits (Correct answer)

Correct answer: Traffic Class (TC) bits

RFC 5462 renamed the MPLS EXP field to Traffic Class (TC) bits, reflecting its primary use for QoS marking in MPLS networks.

Question 28: Which StackWise technology feature allows a failed stack master to be replaced without disrupting traffic forwarding?

BFD
Stateful Switchover (SSO) (Correct answer)
GracefulRestart
NSF (Non-Stop Forwarding)

Correct answer: Stateful Switchover (SSO)

SSO (Stateful Switchover) synchronizes the standby supervisor's state so it can take over as master without disrupting the forwarding plane.

Question 29: In Cisco's intent-based networking, what does 'Network Assurance' primarily verify?

Firewall rule compliance
Physical layer cable integrity
BGP prefix hijack detection
That the network's actual behavior matches the operator's intent (Correct answer)

Correct answer: That the network's actual behavior matches the operator's intent

Network Assurance continuously monitors telemetry and compares actual network behavior against the configured intent, flagging deviations proactively.

Question 30: Which mechanism does WRED use to proactively drop packets before a queue fills completely?

Priority inversion
Strict scheduling
Random early detection based on average queue depth and DSCP/IP Precedence (Correct answer)
Tail drop at 100% queue depth

Correct answer: Random early detection based on average queue depth and DSCP/IP Precedence

WRED randomly drops packets based on average queue depth and traffic priority before the queue fills, reducing TCP synchronization.

Question 31: Which support level does SNMPv3 not support?

authPriv
authNoPriv
noAuthNoPriv
noAuthPriv (Correct answer)

Correct answer: noAuthPriv

The noAuthNoPriv, authNoPriv, and authPriv security levels are supported by SNMP Version 3.

Question 32: Which multicast address does LDP send its hellos to?

224.0.0.5
None of the above
224.0.0.2 (Correct answer)
224.0.0.10

Correct answer: 224.0.0.2

LDP uses the well-known IPv4 multicast address 224.0.0.2 for sending its Hello messages. This address is specifically reserved for all routers on a segment, allowing LDP-enabled routers to discover each other without prior configuration. This efficient discovery mechanism is crucial for establishing LDP adjacencies and building an MPLS domain.

Question 33: Which LDP message type is used by a router to advertise its label bindings to neighbors?

Notification message
Hello message
Label Mapping message (Correct answer)
Initialization message

Correct answer: Label Mapping message

LDP Label Mapping messages carry FEC-to-label bindings that a router distributes to its LDP peers.

Question 34: In NAT, what does PAT (Port Address Translation) allow?

Static mapping of well-known ports
Bidirectional NAT translation
Many internal hosts to share a single public IP by using unique source port numbers (Correct answer)
One-to-one IP mapping

Correct answer: Many internal hosts to share a single public IP by using unique source port numbers

PAT (also called NAT overload) allows many internal hosts to share one public IP by differentiating connections with unique source port numbers.

Question 35: Which Cisco technology provides the underlay network automation and telemetry for SD-WAN fabrics?

APIC
Prime Infrastructure
DNA Center (Correct answer)
NSO

Correct answer: DNA Center

Cisco DNA Center provides network automation, assurance, and analytics that complement SD-WAN underlay management.

Question 36: Which VXLAN component is responsible for handling BUM (Broadcast, Unknown unicast, Multicast) traffic in an ingress replication model?

ARP suppression table
EVPN Route Type 3
VTEP flood list (Correct answer)
Multicast group mapping

Correct answer: VTEP flood list

In VXLAN ingress replication, each VTEP maintains a flood list of remote VTEPs and replicates BUM traffic to each peer unicast.

Question 37: Which of the following is true regarding Cisco Express Forwarding?

It makes forwarding decisions by a process that is scheduled through the IOS scheduler.
It maintains two tables in the data plane: the FIB and adjacency table. (Correct answer)
It uses a fast cache that is maintained in a router data plane.
The CPU of a router becomes directly involved with packet-switching decisions.

Correct answer: It maintains two tables in the data plane: the FIB and adjacency table.

The statement regarding Cisco Express Forwarding (CEF) is true. CEF is a high-performance IP switching technology used in Cisco routers to improve the efficiency of packet forwarding.

Question 38: Where is radio resource management carried out in a wireless Cisco SD-Access solution?

Cisco CMX
control plane node (Correct answer)
wireless controller
DNA Center

Correct answer: control plane node

In a wireless Cisco SD-Access solution, radio resource management is carried out by the "control plane node." The control plane node is a key component in the SD-Access fabric that is responsible for managing and coordinating the wireless network resources.

Question 39: In Rapid PVST+ (802.1w), which port role replaces the traditional Blocking port in classic STP?

Discarding port
Edge port
Backup port
Alternate port (Correct answer)

Correct answer: Alternate port

RSTP introduces the Alternate port role, which provides a pre-calculated backup path to the root and can transition quickly when the root port fails.

Question 40: In a Zone-Based Firewall (ZBF), what happens to traffic between two zones that have no zone-pair policy defined?

Traffic is logged only
Traffic is dropped (Correct answer)
Traffic is inspected
Traffic is permitted by default

Correct answer: Traffic is dropped

In ZBF, traffic between zones is implicitly denied unless a zone-pair with a service policy explicitly permits or inspects it.

Question 41: What is the default OSPF hello interval on a broadcast (Ethernet) network type?

5 seconds
10 seconds (Correct answer)
20 seconds
30 seconds

Correct answer: 10 seconds

On broadcast network types, OSPF uses a default hello interval of 10 seconds and a dead interval of 40 seconds (4x hello).

Question 42: What is the default MPLS label value reserved for the IPv4 explicit null label?

2
0 (Correct answer)
3
1

Correct answer: 0

Label value 0 is the IPv4 Explicit Null label, signaling the egress PE to pop the label and forward based on the IPv4 header.

Question 43: What is the SNMP OID structure based on?

A hierarchical tree defined by the Management Information Base (MIB) (Correct answer)
Base-64 encoding
IP address subnetting
Hexadecimal MAC addresses

Correct answer: A hierarchical tree defined by the Management Information Base (MIB)

SNMP Object Identifiers (OIDs) are structured as a hierarchical dotted-decimal tree defined by the MIB standard.

Question 44: In a Cisco ACI fabric, which component acts as the centralized policy and management controller?

APIC (Correct answer)
vCenter plugin
Leaf switch
Spine switch

Correct answer: APIC

The Application Policy Infrastructure Controller (APIC) is the centralized automation and policy engine for Cisco ACI, managing the entire fabric.

Question 45: In LISP, what does the ITR do when it cannot find an EID-to-RLOC mapping in its cache?

Sends a Map-Request to the Map Resolver (Correct answer)
Sends the packet natively
Floods the packet
Drops the packet

Correct answer: Sends a Map-Request to the Map Resolver

When the ITR has a cache miss, it sends a Map-Request to the Map Resolver to obtain the EID-to-RLOC mapping.

Question 46: Which QoS component modifies a packet to influence how network traffic is handled?

policing
shaping
classification
marking (Correct answer)

Correct answer: marking

The Quality of Service (QoS) component that modifies a packet to influence how network traffic is handled is called "marking." <br> <br> In QoS implementation, packets are marked with specific values or tags in their headers to indicate their priority or class of service. These markings allow network devices, such as routers and switches, to identify and treat the packets differently based on their assigned priority. By modifying packets with appropriate markings, network administrators can control and prioritize the handling of different types of traffic to ensure that critical data receives better treatment and resources compared to less important traffic.

Question 47: Which EIGRP metric components are used by default in the composite metric calculation?

Bandwidth and Delay (Correct answer)
Delay and Load
Bandwidth and Reliability
Bandwidth, Delay, Reliability, Load, and MTU

Correct answer: Bandwidth and Delay

By default, EIGRP uses only Bandwidth and Delay (K1=1, K3=1) in its composite metric; Reliability, Load, and MTU have K-values of 0.

Question 48: In a DMVPN Phase 3 network, which protocol allows spoke-to-spoke tunnels to form dynamically while still routing through the hub initially?

OSPF virtual link
BGP route reflector
NHRP redirect (Correct answer)
EIGRP with summarization

Correct answer: NHRP redirect

In DMVPN Phase 3, NHRP redirect messages from the hub enable spokes to learn each other's NBMA addresses and build direct spoke-to-spoke tunnels.

Question 49: A switch receives a frame with a destination MAC address not found in its CAM table. What action does it take?

Sends an ARP request
Drops the frame silently
Floods the frame out all ports except the ingress port (Correct answer)
Forwards the frame to the default gateway

Correct answer: Floods the frame out all ports except the ingress port

When a destination MAC is unknown, the switch floods the frame out all ports in the same VLAN except the port it arrived on — this is called unknown unicast flooding.

Question 50: What DSCP value corresponds to Expedited Forwarding (EF), commonly used for voice traffic?

DSCP 46 (Correct answer)
DSCP 26
DSCP 48
DSCP 10

Correct answer: DSCP 46

Expedited Forwarding (EF) is defined as DSCP 46 (binary 101110) and is used for delay-sensitive traffic like VoIP.

Question 51: Each end of the rolled (rollover or console) cable that links a PC to a console port on a Cisco switch connects to either a PC or the console port. What belongs to what?

Serial interface goes to both the console and the PC
RJ-45 interface goes to the PC while the serial interface goes to the console
RJ-45 interface goes to the console while the serial interface goes to the PC (Correct answer)
RJ-45 interface goes to both the console and the PC

Correct answer: RJ-45 interface goes to the console while the serial interface goes to the PC

A Cisco console cable, often called a rollover cable, is used to connect a PC to a switch's console port for initial configuration and out-of-band management. The RJ-45 connector end of this cable plugs into the console port on the Cisco switch. The serial interface (typically a DB-9 connector) on the other end connects to the serial port (COM port) of the PC.

Question 52: Which QoS scheduling mechanism guarantees minimum bandwidth to each class while allowing unused bandwidth to be shared among queues?

Class-Based Weighted Fair Queuing (CBWFQ) (Correct answer)
Priority Queuing (PQ)
Low Latency Queuing (LLQ)
Weighted Fair Queuing (WFQ)

Correct answer: Class-Based Weighted Fair Queuing (CBWFQ)

CBWFQ assigns guaranteed minimum bandwidth to each traffic class and distributes any excess bandwidth proportionally among all classes.

Question 53: What is the proper JSON syntax for an array?

Key; value
Key: value;
Key-value
[value] (Correct answer)

Correct answer: [value]

[value] is the proper syntax in JSON for an array. This indicates that each array is made up of a list of values that are enclosed in square brackets and are separated by commas.

Question 54: Which Spanning Tree Protocol feature allows a port to immediately transition to forwarding state when connected to an end device?

BPDU Guard
Loop Guard
PortFast (Correct answer)
Root Guard

Correct answer: PortFast

PortFast bypasses the STP listening and learning states, allowing an edge port to immediately enter forwarding state.

Question 55: In a ZBF configuration, which zone do router interfaces belong to by default?

no zone (no default) (Correct answer)
outside zone
trust zone
self zone

Correct answer: no zone (no default)

Router interfaces are not automatically placed in any zone; they must be explicitly assigned to a zone for ZBF to apply.

Question 56: What command is entered into a router to enable an EEM applet?

None of the above
Router# event manager applet enable
Router(config)# event manager applet enable (Correct answer)
Router(config)# event manager policy enable

Correct answer: Router(config)# event manager applet enable

The router(config)# event manager applet enable command can be used to enable an EEM applet on a router.

Question 57: Which component in an NFV architecture is responsible for lifecycle management of VNFs?

OSS
VNFM (Correct answer)
NFVI
VIM

Correct answer: VNFM

The VNF Manager (VNFM) handles instantiation, scaling, update, and termination of VNF instances.

Question 58: What is the BGP best-path selection criterion immediately following 'Highest Weight'?

Highest LOCAL_PREF (Correct answer)
Lowest MED
Prefer eBGP over iBGP
Lowest AS_PATH length

Correct answer: Highest LOCAL_PREF

After Highest Weight (Cisco proprietary, local to router), BGP selects the path with the Highest LOCAL_PREF, which is shared across the local AS.

Question 59: Which action would be considered a design best-practice for the core layer in a three-tier hierarchical campus network design?

provide advanced network security features such as 802.1X, DHCP snooping, VACLs, and port security
provide QoS prioritization services such as marking, queueing, and classification for critical network traffic
provide redundant aggregation for access layer devices and first-hop redundancy protocols such as VRRP
provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence (Correct answer)

Correct answer: provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence

The action that would be considered a design best-practice for the core layer in a three-tier hierarchical campus network design is to "provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence."

Question 60: Which OSPF router type and command is used to perform inter-area route summarization?

ABR using `area range` (Correct answer)
Internal router using `ip summary-address eigrp`
Backbone router using `aggregate-address`
ASBR using `summary-address`

Correct answer: ABR using `area range`

Inter-area summarization in OSPF is configured on ABRs with the `area range` command, which aggregates Type 3 Summary LSAs sent between areas.

Question 61: What element determines whether a wired client has access to the network when it connects to an edge switch in a Cisco SD-Access fabric?

edge node
Identity Services Engine (Correct answer)
RADIUS server
control-plane node

Correct answer: Identity Services Engine

In a Cisco SD-Access (Software-Defined Access) fabric, the element that determines whether a wired client has access to the network when it connects to an edge switch is the "Identity Services Engine" (ISE). The Identity Services Engine is a powerful network access control and policy management platform that plays a crucial role in ensuring secure and controlled access to the network.

Question 62: In NFV, which component provides the virtual infrastructure resources such as compute, storage, and networking?

OSS/BSS
VNF
MANO
NFVI (Correct answer)

Correct answer: NFVI

The NFV Infrastructure (NFVI) encompasses the hardware and virtualization layers that host the VNFs.

Question 63: Which Cisco technology uses a control plane that is physically separated from the data plane across the entire network fabric?

VTP
MPLS
SD-Access (Correct answer)
EIGRP

Correct answer: SD-Access

SD-Access separates the control plane from the data plane using a centralized controller (Cisco DNA Center) to manage the entire fabric.

Question 64: Which switch feature prevents IP packets from being forwarded when the source IP address does not match the DHCP snooping binding table entry for a port?

Port Security
IP Source Guard (Correct answer)
BPDU Guard
Dynamic ARP Inspection

Correct answer: IP Source Guard

IP Source Guard uses the DHCP snooping binding table to verify the source IP of packets, dropping any that do not match the expected binding for that port.

Question 65: What categories does LISP divide IP addresses into?

RLOCs (Correct answer)
EIDs (Correct answer)
Subnets and hosts
LISP entities

Correct answer: RLOCs

LISP divides IP addresses into route locators and endpoint identifiers (EIDs) (RLOCs).

Question 66: Change the PORT LED's status on the LED. Choose the appropriate response(s) for the matching hue and description.

OFF - The link is not working (Correct answer)
AMBER - Link is on but interface is administratively disabled
Solid GREEN - link is working
AMBER (flashing) - Link is on but interface is administratively disabled (Correct answer)

Correct answer: OFF - The link is not working

The PORT LED on a Cisco switch indicates the status of an individual port. If the LED is OFF, it signifies that there is no active link on that port, meaning the link is not working or the cable is disconnected. A flashing AMBER LED typically indicates that the port is administratively disabled, in a fault state, or blocked by Spanning Tree Protocol (STP) to prevent network loops.

Question 67: What is the function of a Cisco DNA Center intent-based networking API?

Directly push CLI commands to devices
Express the desired network state and let the platform determine how to implement it (Correct answer)
Monitor power consumption
Capture raw packet data

Correct answer: Express the desired network state and let the platform determine how to implement it

Intent-based networking APIs allow operators to declare the desired outcome, with DNA Center translating that intent into device-level configurations.

Question 68: Which CAPWAP port does control traffic between an AP and WLC use?

UDP 5246 (Correct answer)
TCP 443
TCP 22
UDP 5247

Correct answer: UDP 5246

CAPWAP control traffic uses UDP port 5246, while CAPWAP data traffic uses UDP port 5247.

Question 69: Which NTP stratum level indicates the NTP server is directly connected to an authoritative time source?

Stratum 15
Stratum 1 (Correct answer)
Stratum 0
Stratum 2

Correct answer: Stratum 1

Stratum 1 NTP servers are directly synchronized to a Stratum 0 reference clock (e.g., GPS or atomic clock).

Question 70: Which type of Cisco ACL is evaluated closest to the destination and can filter based on source AND destination addresses?

Extended ACL applied inbound near source
Standard ACL applied inbound near source
Extended ACL applied outbound near destination (Correct answer)
Standard ACL applied outbound near destination

Correct answer: Extended ACL applied outbound near destination

Extended ACLs match on source/destination IP and port; applying them outbound near the destination is valid, though best practice is inbound near the source to drop traffic early.

Question 71: In order to return to the SETUP MODE or the ORIGINAL CONFIGURATION MODE,

Power on and off the switch, pray that the initial configuration mode comes up
Type setup under CONFIGURATION mode
Type setup under PRIVILEDGE mode (Correct answer)
Type reload and setup mode will resume after switch reboots

Correct answer: Type setup under PRIVILEDGE mode

To re-enter the initial setup mode on a Cisco device, you must be in privileged EXEC mode (indicated by the `#` prompt). From there, typing the `setup` command will launch the initial configuration dialog, allowing you to configure basic device settings as if it were a new device. This is useful for re-configuring fundamental parameters or reviewing initial setup options.

Question 72: Which protocol does Cisco DNA Center use to push configuration changes to network devices in a model-driven way?

SSHv1
RESTCONF/NETCONF (Correct answer)
SNMP v3
Telnet

Correct answer: RESTCONF/NETCONF

Cisco DNA Center uses NETCONF and RESTCONF over SSH/HTTPS to push YANG-modeled configurations to managed devices.

Question 73: In VXLAN, what is the role of the VTEP (VXLAN Tunnel Endpoint)?

Provides control plane signaling via LISP
Encapsulates/decapsulates Layer 2 frames in UDP packets (Correct answer)
Routes packets between different VNIs
Manages multicast group membership

Correct answer: Encapsulates/decapsulates Layer 2 frames in UDP packets

The VTEP encapsulates Layer 2 Ethernet frames into UDP/IP packets for transport across the Layer 3 underlay network.

Question 74: Which QoS model provides per-flow resource reservation using RSVP signaling?

Best Effort
DiffServ
LLQ
IntServ (Correct answer)

Correct answer: IntServ

Integrated Services (IntServ) uses RSVP to reserve bandwidth and guarantee QoS on a per-flow basis end-to-end.

Question 75: On a switch, debugging is enabled. For instance, I wish to debug the IP ICMP packet switch. Debugging would end if I would

Type no debug IP ICMP
Type undebug all
All of the above (Correct answer)
Type no debug all
Reload the switch

Correct answer: All of the above

To stop debugging on a Cisco switch, you have several effective options. Typing `no debug ip icmp` specifically disables the ICMP debugging. `undebug all` or `no debug all` disables all active debugging sessions. Additionally, reloading the switch will clear its running configuration, including any active debug commands, effectively ending all debugging.

Question 76: Which label is used in MPLS OAM to perform a router-alert function similar to IP router-alert?

Label 1 (Correct answer)
Label 2
Label 0
Label 14

Correct answer: Label 1

Label 1 is the Router Alert label, which causes each transit LSR to examine the packet more closely rather than just switching it.

Question 77: Wireless LAN (WLAN) communication is done using a technique called orthogonal frequency division multiplexing (OFDM). Which three WLAN protocols among the following support OFDM?

802.11a
802.11n
all of the above (Correct answer)
802.11g

Correct answer: all of the above

Both 802.11b and 802.11g feature Direct-Sequence Spread Spectrum (DSSS). 802.11a, 802.11g, and 802.11n all enable orthogonal frequency division multiplexing (OFDM). Keep in mind that 802.11g can support DSSS or OFDM. Using a collection of symbols referred to as "chips," DSSS modulates data over a wide frequency range. Because a chip lasts less time than a bit, chips are transmitted more quickly than actual data. These chips additionally encrypt what seems to be random data in addition to the data that will be transferred. In spite of the fact that both parties to a DSSS communication are aware of which chips represent valid data and which do not if a third party were to intercept a DSSS transmission, it would be challenging for them to eavesdrop on the information because they would not be able to quickly identify which chips contained valid bits. OFDM employs a relatively moderate modulation rate for its symbols compared to DSSS's high modulation rate. OFDM is able to sustain high data rates thanks to its slower modulation rate and the simultaneous delivery of data over 52 data streams.

Question 78: You return to your command line with all characters after doing this. When messages clog up the screen, this is helpful.

Right arrow or Ctrl-F
Left arrow or Ctr-B
Ctrl-R (Correct answer)
Ctrl-A

Correct answer: Ctrl-R

In Cisco IOS CLI, pressing `Ctrl-R` (Redraw Line) is used to redraw the current command line. This is particularly useful when unsolicited console messages or debug output interrupt your typing, causing the command you are entering to become garbled or pushed off-screen. `Ctrl-R` brings the command back into view, allowing you to continue typing without losing your progress.

Question 79: In MPLS VPN, what address family does the PE router use to distribute VPN routes between PEs via BGP?

IPv6 unicast
IPv4 unicast
L2VPN EVPN
VPNv4 (Correct answer)

Correct answer: VPNv4

PEs use the VPNv4 address family (RFC 4364) which prepends a Route Distinguisher to IPv4 prefixes to make them globally unique.

Question 80: Which IPv6 address type is automatically assigned to every IPv6-enabled interface and is used for neighbor discovery and routing protocol communications on the local link?

Anycast
Link-Local (FE80::/10) (Correct answer)
Unique Local
Global Unicast

Correct answer: Link-Local (FE80::/10)

Link-local addresses in the FE80::/10 range are automatically configured on every IPv6 interface and are used for NDP, routing protocol hellos, and default gateway communication.

Question 81: Which type of EVPN BGP route is used to advertise MAC and IP binding information learned from a local host?

Route Type 3 (Inclusive Multicast)
Route Type 1 (Ethernet Auto-Discovery)
Route Type 2 (MAC/IP Advertisement) (Correct answer)
Route Type 5 (IP Prefix)

Correct answer: Route Type 2 (MAC/IP Advertisement)

EVPN Route Type 2 carries MAC address and optional IP address bindings to enable L2 reachability across VXLAN fabric.

Question 82: Which QoS mechanism is used to prevent a single traffic flow from monopolizing bandwidth through token consumption limits?

Weighted Fair Queuing
Policing (Correct answer)
CBWFQ
Shaping

Correct answer: Policing

Policing drops or re-marks traffic that exceeds the configured rate, immediately discarding excess tokens without buffering.

Question 83: Two device functions in the Cisco SD-Access fabric are what? (Select two.)

vBond controller
edge node (Correct answer)
border node (Correct answer)
access switch
core switch

Correct answer: edge node

In a Cisco SD-Access fabric, the edge node connects endpoints to the fabric and provides their initial access (the border node is the other fabric role). 'Access switch' and 'core switch' are traditional network terms, and the vBond controller belongs to SD-WAN, not SD-Access.

Question 84: A Cisco Catalyst switch is configured with 'switchport mode dynamic desirable' on both ends of a link. What will the result be?

Trunk port negotiated via DTP (Correct answer)
Access port on both sides
The link will not come up
One side becomes access, the other trunk

Correct answer: Trunk port negotiated via DTP

When both ends are set to dynamic desirable, DTP negotiates a trunk link because both sides are actively trying to form a trunk.

Question 85: A network engineer needs to prevent a specific BGP prefix from being advertised to an eBGP peer. Which mechanism is most appropriate?

MED attribute adjustment
Outbound route filter with a prefix-list (Correct answer)
BGP confederations
Route reflector

Correct answer: Outbound route filter with a prefix-list

An outbound route filter using a prefix-list applied to the neighbor statement blocks specific prefixes from being sent to an eBGP peer.

Question 86: The vSmart controller is in charge of what in an SD-WAN deployment?

distribute security information for tunnel establishment between vEdge routers (Correct answer)
gather telemetry data from vEdge routers
onboard vEdge nodes into the SD-WAN fabric
manage, maintain, and gather configuration and status for nodes within the SD-WAN fabric

Correct answer: distribute security information for tunnel establishment between vEdge routers

In an SD-WAN (Software-Defined Wide Area Network) deployment, the vSmart controller is in charge of distributing security information for tunnel establishment between vEdge routers. The vSmart controller is a centralized management and control plane element in the SD-WAN architecture. It plays a critical role in overseeing the entire SD-WAN fabric and facilitating communication and coordination among the various SD-WAN devices, including vEdge routers, vBond orchestrators, and vManage network management system.

Question 87: What is the primary function of LISP (Locator/ID Separation Protocol) in a campus fabric deployment?

Separating endpoint identity (EID) from routing location (RLOC) to enable mobility (Correct answer)
Providing QoS markings for campus traffic
Encrypting all inter-VLAN traffic
Replacing OSPF as the campus routing protocol

Correct answer: Separating endpoint identity (EID) from routing location (RLOC) to enable mobility

LISP separates the endpoint identifier (EID) from its topological location (RLOC), enabling seamless endpoint mobility across different fabric sites.

Question 88: Makes progress 1 word.

Esc-F (Correct answer)
Down arrow or Ctrl-N
Ctrl-A
Left arrow or Ctr-B

Correct answer: Esc-F

In Cisco IOS CLI, `Esc-F` is a keyboard shortcut used to move the cursor forward one word at a time. This command is part of the command-line editing features, allowing users to navigate and modify commands more efficiently than moving character by character. It helps in quickly jumping across words within a command string.

Question 89: In infrastructure as code, what is the key characteristic of an idempotent operation?

It runs faster each time it executes
It requires elevated privileges
It produces the same result regardless of how many times it is applied (Correct answer)
It reverses previous changes

Correct answer: It produces the same result regardless of how many times it is applied

An idempotent operation can be applied multiple times without changing the result beyond the first application, ensuring consistent state.

Question 90: What kind of Wi-Fi encryption technique does pre-shared key (PSK) authentication normally employ?

SHA-1
AES (Correct answer)
DES
MD5

Correct answer: AES

To achieve the highest level of security, Advanced Encryption Standard (AES) is often employed with Pre-Shared Key (PSK) authentication.

Question 91: A network runs OSPF with multiple areas. Which LSA type carries summary routes from one area into another through the ABR?

Type 2 (Network LSA)
Type 5 (AS External LSA)
Type 3 (Summary LSA) (Correct answer)
Type 1 (Router LSA)

Correct answer: Type 3 (Summary LSA)

Type 3 Summary LSAs are generated by ABRs to advertise inter-area routes between OSPF areas.

Implementing and Operating Cisco Enterprise Network Core Technologies (350-401 ENCOR)

The Cisco ENCOR (350-401) exam certifies a candidate's knowledge of implementing core enterprise network technologies, including dual-stack (IPv4 and IPv6) architecture, virtualization, infrastructure, network assurance, security, and automation.

Questions

120 min

Time Limit

82%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds