Implementing and Operating Cisco Enterprise Network Core Technologies (350-401 ENCOR) — Questions and Answers

Question 1: What Cisco-exclusive technology is MPLS based on?

ISL
CEF (Correct answer)
PaGP
None of the above

Correct answer: CEF

MPLS (Multiprotocol Label Switching) is built upon Cisco Express Forwarding (CEF) for its high-speed packet forwarding capabilities. CEF pre-computes the entire forwarding path for IP packets, creating a Forwarding Information Base (FIB) and adjacency table. MPLS leverages these pre-computed paths, replacing slower IP lookups with efficient label lookups for faster data plane operations.

Question 2: In OSPF, what is the purpose of the 'ip ospf network point-to-point' command on a multi-access interface?

Eliminates DR/BDR election and treats the link as a direct peer connection (Correct answer)
Enables OSPF authentication on the interface
Changes the OSPF hello interval to 10 seconds
Forces DR/BDR election on the segment

Correct answer: Eliminates DR/BDR election and treats the link as a direct peer connection

Configuring 'point-to-point' network type on a multi-access interface bypasses DR/BDR election, reducing convergence overhead when only two OSPF neighbors exist.

Question 3: Which label is used in MPLS OAM to perform a router-alert function similar to IP router-alert?

Label 0
Label 1 (Correct answer)
Label 2
Label 14

Correct answer: Label 1

Label 1 is the Router Alert label, which causes each transit LSR to examine the packet more closely rather than just switching it.

Question 4: What is the default STP port cost for a 1 Gbps link using the IEEE short path cost method?

200
4 (Correct answer)
19
100

Correct answer: 4

Using the IEEE 802.1D short (16-bit) path cost method, a 1 Gbps link has a default cost of 4.

Question 5: What is the default administrative distance of an EIGRP internal route?

100
70
110
90 (Correct answer)

Correct answer: 90

EIGRP internal routes have an administrative distance of 90, making them preferred over OSPF (110) but less preferred than static routes (1).

Question 6: ______ handles label swapping and transfers data based on L3 or L2 information.

Control plane
Control plane
Transport plane
Data plane (Correct answer)

Correct answer: Data plane

The data plane, also known as the forwarding plane, is responsible for the actual forwarding of packets based on the information established by the control plane. In MPLS, the data plane performs label swapping and transfers data packets using the Label Forwarding Information Base (LFIB), which maps incoming labels to outgoing labels and interfaces, enabling high-speed packet delivery.

Question 7: Which QoS model provides per-flow resource reservation using RSVP signaling?

LLQ
DiffServ
Best Effort
IntServ (Correct answer)

Correct answer: IntServ

Integrated Services (IntServ) uses RSVP to reserve bandwidth and guarantee QoS on a per-flow basis end-to-end.

Question 8: In SNMPv3, which security level provides both authentication and encryption?

noAuthNoPriv
readOnly
authNoPriv
authPriv (Correct answer)

Correct answer: authPriv

The authPriv security level uses HMAC for authentication and DES/AES for privacy (encryption) of SNMP messages.

Question 9: What is one truth about the use of Cisco SD-Access in wireless networks?

The WLC is part of the fabric underlay.
The access point is part of the fabric underlay.
The wireless client is part of the fabric overlay.
The access point is part of the fabric overlay. (Correct answer)

Correct answer: The access point is part of the fabric overlay.

One truth about the use of Cisco SD-Access in wireless networks is that "the access point is part of the fabric overlay." In Cisco SD-Access, the fabric overlay extends to wireless networks, allowing seamless integration and management of wired and wireless endpoints within the same fabric. This means that wireless access points (APs) are considered an integral part of the SD-Access fabric and are treated as part of the overlay network.

Question 10: In infrastructure as code, what is the key characteristic of an idempotent operation?

It produces the same result regardless of how many times it is applied (Correct answer)
It runs faster each time it executes
It reverses previous changes
It requires elevated privileges

Correct answer: It produces the same result regardless of how many times it is applied

An idempotent operation can be applied multiple times without changing the result beyond the first application, ensuring consistent state.

Question 11: In Cisco SD-WAN, which protocol is used between vSmart controllers and WAN Edge routers to exchange routes and policies?

EIGRP
BGP
OSPF
OMP (Correct answer)

Correct answer: OMP

OMP (Overlay Management Protocol) is Cisco's proprietary SD-WAN control plane protocol used between vSmart and WAN Edge devices.

Question 12: What advantages do on-premises infrastructure deployments have over cloud infrastructure deployments?

ability to quickly increase compute power without the need to install additional hardware
lower latency between systems that are physically located near each other (Correct answer)
faster deployment times because additional infrastructure does not need to be purchased
less power and cooling resources needed to run infrastructure on-premises

Correct answer: lower latency between systems that are physically located near each other

On-premises infrastructure deployments have certain advantages over cloud infrastructure deployments, and one of them is lower latency between systems that are physically located near each other.

Question 13: In the context of REST APIs for network automation, which HTTP method is idempotent and used to completely replace a resource?

PUT (Correct answer)
POST
PATCH
DELETE

Correct answer: PUT

PUT replaces the entire resource at the specified URI and is idempotent — sending the same PUT request multiple times produces the same result.

Question 14: How is network congestion alleviated by QoS traffic shaping?

It drops packets when traffic exceeds a certain bitrate.
It drops packets randomly from lower priority queues.
It fragments large packets and queues them for delivery.
It buffers and queues packets above the committed rate. (Correct answer)

Correct answer: It buffers and queues packets above the committed rate.

Network congestion can be alleviated by QoS (Quality of Service) traffic shaping through the use of packet buffering and queuing. When traffic shaping is implemented, it regulates the flow of packets to ensure that they adhere to specific bandwidth limits and priorities, which helps to manage network congestion

Question 15: Which header field uniquely identifies a VXLAN segment and is carried in the VXLAN header?

VNI (VXLAN Network Identifier) (Correct answer)
MPLS label
VLAN tag
GRE key

Correct answer: VNI (VXLAN Network Identifier)

The 24-bit VNI in the VXLAN header identifies the individual virtual network segment.

Question 16: Which EIGRP metric components are used by default in the composite metric calculation?

Bandwidth and Delay (Correct answer)
Bandwidth and Reliability
Delay and Load
Bandwidth, Delay, Reliability, Load, and MTU

Correct answer: Bandwidth and Delay

By default, EIGRP uses only Bandwidth and Delay (K1=1, K3=1) in its composite metric; Reliability, Load, and MTU have K-values of 0.

Question 17: What is the function of IP SLA in Cisco IOS?

Configure QoS policies
Assign DSCP markings
Shape outbound traffic
Proactively measure network performance metrics like latency, jitter, and packet loss (Correct answer)

Correct answer: Proactively measure network performance metrics like latency, jitter, and packet loss

Cisco IP SLA generates synthetic test traffic to continuously measure network performance metrics such as delay, jitter, and availability.

Question 18: On a switch, debugging is enabled. For instance, I wish to debug the IP ICMP packet switch. Debugging would end if I would

Type no debug all
Reload the switch
All of the above (Correct answer)
Type no debug IP ICMP
Type undebug all

Correct answer: All of the above

To stop debugging on a Cisco switch, you have several effective options. Typing `no debug ip icmp` specifically disables the ICMP debugging. `undebug all` or `no debug all` disables all active debugging sessions. Additionally, reloading the switch will clear its running configuration, including any active debug commands, effectively ending all debugging.

Question 19: This advances the cursor in the command that is now being displayed without deleting any characters.

Left arrow or Ctr-B (Correct answer)
Esc-B
Right arrow or Ctrl-F
Down arrow or Ctrl-N

Correct answer: Left arrow or Ctr-B

In the Cisco IOS command-line interface, the left arrow key or the Ctrl-B key combination moves the cursor one character to the left. This allows you to navigate backward within the current command line to make edits or review input without deleting any characters, providing precise cursor control.

Question 20: What is the purpose of SNMP traps?

Poll devices for MIB data
Authenticate SNMP community strings
Allow managers to set device configuration
Send asynchronous event notifications from agent to manager (Correct answer)

Correct answer: Send asynchronous event notifications from agent to manager

SNMP traps are unsolicited notifications sent by an SNMP agent to the manager when a significant event occurs.

Question 21: A network engineer needs to prevent a specific BGP prefix from being advertised to an eBGP peer. Which mechanism is most appropriate?

BGP confederations
MED attribute adjustment
Route reflector
Outbound route filter with a prefix-list (Correct answer)

Correct answer: Outbound route filter with a prefix-list

An outbound route filter using a prefix-list applied to the neighbor statement blocks specific prefixes from being sent to an eBGP peer.

Question 22: Which feature builds upon DHCP Snooping to prevent hosts from sending traffic with a spoofed source IP?

802.1X
BPDU Guard
Dynamic ARP Inspection
IP Source Guard (Correct answer)

Correct answer: IP Source Guard

IP Source Guard uses the DHCP Snooping binding table to filter packets with source IPs that don't match the legitimate binding.

Question 23: What do solutions for application whitelisting serve?

To detect and block malicious software on an endpoint
To protect an endpoint from network threats
To monitor and control the activities of users on an endpoint
To prevent unauthorized applications from being installed/ran on an endpoint (Correct answer)

Correct answer: To prevent unauthorized applications from being installed/ran on an endpoint

To stop unauthorized apps from being installed or run on an endpoint, application whitelisting solutions are used. It does not safeguard an endpoint from network risks, identify and prevent harmful applications, or track and manage user activity.

Question 24: What is the administrative distance of OSPF internal routes on a Cisco router?

90
100
120
110 (Correct answer)

Correct answer: 110

OSPF internal routes have an administrative distance of 110 in Cisco IOS, making them less preferred than EIGRP (90) but more preferred than RIP (120).

Question 25: What is the maximum number of equal-cost paths that OSPF supports for load balancing by default on Cisco IOS?

4 (Correct answer)
16
6
8

Correct answer: 4

OSPF defaults to 4 equal-cost paths for load balancing, though this can be increased with the 'maximum-paths' command.

Question 26: In a Cisco SD-WAN fabric, which component is responsible for centralized policy and management?

vSmart
vBond
vManage (Correct answer)
vEdge

Correct answer: vManage

vManage is the centralized NMS/orchestrator for Cisco SD-WAN, handling policy, monitoring, and configuration.

Question 27: What is the role of the Rendezvous Point (RP) in PIM Sparse Mode multicast?

It serves as the meeting point for sources and receivers (Correct answer)
It manages IGMP group membership reports
It forwards all multicast traffic to all routers
It encrypts multicast streams

Correct answer: It serves as the meeting point for sources and receivers

The RP in PIM-SM acts as the central meeting point where multicast sources register and receivers join, enabling source-to-receiver path setup.

Question 28: Change the status of the DUPLX (duplex) LED. Choose the appropriate response(s) for the matching hue and description.

LED is OFF means no duplex (Correct answer)
LED is green means half duplex
LED is green means full duplex (Correct answer)

Correct answer: LED is OFF means no duplex

On Cisco switches, the DUPLX (duplex) LED indicates the operational duplex mode of a port. A solid green LED signifies that the port is operating in full-duplex mode, enabling simultaneous two-way communication. If the DUPLX LED is off, it means the port is not in full-duplex, indicating either half-duplex operation or no active link.

Question 29: Which wireless security protocol replaced WPA2 and introduced Simultaneous Authentication of Equals (SAE)?

WPA
802.11i
WPA2-Enterprise
WPA3 (Correct answer)

Correct answer: WPA3

WPA3 introduced SAE (Dragonfly handshake) to replace PSK, providing forward secrecy and resistance to offline dictionary attacks.

Question 30: In a FlexConnect AP deployment, what happens to client traffic when the WLC connection is lost?

All clients are disconnected
Traffic is dropped until the WLC reconnects
The AP reboots automatically
The AP can locally switch traffic for pre-configured SSIDs (Correct answer)

Correct answer: The AP can locally switch traffic for pre-configured SSIDs

FlexConnect APs in local switching mode can continue to bridge client traffic locally even during WLC connectivity loss.

Question 31: Which authentication technique can be utilized as a backup in the event that the AAA servers go down?

RADIUS
Local database (Correct answer)
LDAP
TACACS+

Correct answer: Local database

Cisco advises that a centralized AAA server should normally be in charge of managing passwords. However, some sensitive data is typically stored locally by Cisco IOS Software and other infrastructure devices. In the event that the AAA servers go down, some local passwords and secret data, such as special-use usernames, secret keys, and other password data, may be needed. For security, such local passwords ought to be encrypted. An example of a AAA server is TACACS+. In the unlikely event that the AAA servers go down, TACACS+ is not employed as a backup support system. An example of a AAA server is RADIUS. RADIUS is not used as backup support in the event that the AAA servers go down. An example of a AAA server is LDAP. LDAP is not used as backup support in the event that the AAA servers go down.

Question 32: This progresses 1 word.

Up arrow or CTRL-P
Left arrow or Ctr-B
Esc-F (Correct answer)
Down arrow or Ctrl-N

Correct answer: Esc-F

In the Cisco IOS command-line interface, the Esc-F key combination (Escape key followed by 'F') moves the cursor forward one word at a time. This is a useful shortcut for quickly navigating through longer commands to reach a specific point for editing or reviewing input more efficiently than moving character by character.

Question 33: What command is entered into a router to enable an EEM applet?

Router(config)# event manager applet enable (Correct answer)
Router# event manager applet enable
None of the above
Router(config)# event manager policy enable

Correct answer: Router(config)# event manager applet enable

The router(config)# event manager applet enable command can be used to enable an EEM applet on a router.

Question 34: A Cisco switch is extremely secure out of the box by design because it.

Only allows console access (Correct answer)
Turns on vty and console password so that secured remote session from SSH and Telnet can be made
Disables all physical and remote access and users have to call Cisco Technical Assistance Center (TAC) to activate the switch first
Only allows remote access from a secured location

Correct answer: Only allows console access

Out of the box, a new Cisco switch is designed with security in mind by only allowing console access. It typically has no IP address configured and no remote access protocols like Telnet or SSH enabled or secured. This ensures that an administrator must physically connect to the device via the console port to perform initial setup and configure network access and security.

Question 35: In wireless networks, what does the term 'roaming' refer to?

Scanning for hidden SSIDs
Changing SSID names
Switching between 2.4 GHz and 5 GHz bands
A client moving between APs while maintaining its network session (Correct answer)

Correct answer: A client moving between APs while maintaining its network session

Roaming is the process by which a wireless client seamlessly transfers its association from one AP to another while maintaining active sessions.

Question 36: What element determines whether a wired client has access to the network when it connects to an edge switch in a Cisco SD-Access fabric?

control-plane node
edge node
Identity Services Engine (Correct answer)
RADIUS server

Correct answer: Identity Services Engine

In a Cisco SD-Access (Software-Defined Access) fabric, the element that determines whether a wired client has access to the network when it connects to an edge switch is the "Identity Services Engine" (ISE). The Identity Services Engine is a powerful network access control and policy management platform that plays a crucial role in ensuring secure and controlled access to the network.

Question 37: What function does the monitoring workflow for the Cisco DNA Center serve?

To configure network devices for optimal performance
To manage and troubleshoot network devices.
To monitor and analyze the network for performance and health issues. (Correct answer)
None of the above

Correct answer: To monitor and analyze the network for performance and health issues.

Monitoring and analysis of the network for performance and health issues is the primary goal of the Cisco DNA Center monitoring workflow.

Question 38: In LISP, which device answers Map-Request queries by providing EID-to-RLOC mappings?

MS/MR (Correct answer)
ETR
PxTR
ITR

Correct answer: MS/MR

The Map Server (MS) and Map Resolver (MR) store and resolve EID-to-RLOC mappings in the LISP control plane.

Question 39: What is the primary function of MACsec (IEEE 802.1AE)?

Segment broadcast domains
Encrypt and integrity-protect traffic at Layer 2 on a hop-by-hop basis (Correct answer)
Prevent MAC address flooding
Authenticate network devices via 802.1X

Correct answer: Encrypt and integrity-protect traffic at Layer 2 on a hop-by-hop basis

MACsec provides line-rate Layer 2 encryption and integrity verification between directly connected devices on each hop.

Question 40: Which 802.1X component authenticates the supplicant and communicates with the authentication server?

Authentication Server
Authenticator (Correct answer)
Supplicant
RADIUS proxy

Correct answer: Authenticator

The authenticator (typically a switch or wireless AP) intercepts the supplicant's credentials and forwards them to the authentication server.

Question 41: Which Python data structure is best suited to store YANG-modeled configuration data retrieved via NETCONF?

Dictionary (dict) (Correct answer)
Set
List
Tuple

Correct answer: Dictionary (dict)

NETCONF returns XML that maps naturally to nested Python dictionaries when parsed with libraries like xmltodict or ncclient.

Question 42: What job does a fabric edge node have in an SD-Access setup?

Connects endpoints to the fabric and forwards their traffic. (Correct answer)
Encapsulates end-user data traffic into LISP.
Connects the SD-Access fabric to another fabric or external Layer 3 networks.
Provides reachability between border nodes in the fabric underlay.

Correct answer: Connects endpoints to the fabric and forwards their traffic.

In an SD-Access (Software-Defined Access) setup, a fabric edge node plays a crucial role in connecting endpoints to the fabric and forwarding their traffic. It serves as the access layer in the SD-Access architecture and is responsible for providing connectivity to end-user devices and IoT devices.

Question 43: Two device functions in the Cisco SD-Access fabric are what? (Select two.)

access switch
border node (Correct answer)
vBond controller
core switch
edge node (Correct answer)

Correct answer: border node

In a Cisco SD-Access fabric, the edge node connects endpoints to the fabric and provides their initial access (the border node is the other fabric role). 'Access switch' and 'core switch' are traditional network terms, and the vBond controller belongs to SD-WAN, not SD-Access.

Question 44: You return to your command line with all characters after doing this. When messages clog up the screen, this is helpful.

Ctrl-A
Left arrow or Ctr-B
Right arrow or Ctrl-F
Ctrl-R (Correct answer)

Correct answer: Ctrl-R

In Cisco IOS CLI, pressing `Ctrl-R` (Redraw Line) is used to redraw the current command line. This is particularly useful when unsolicited console messages or debug output interrupt your typing, causing the command you are entering to become garbled or pushed off-screen. `Ctrl-R` brings the command back into view, allowing you to continue typing without losing your progress.

Question 45: Which StackWise technology feature allows a failed stack master to be replaced without disrupting traffic forwarding?

GracefulRestart
Stateful Switchover (SSO) (Correct answer)
NSF (Non-Stop Forwarding)
BFD

Correct answer: Stateful Switchover (SSO)

SSO (Stateful Switchover) synchronizes the standby supervisor's state so it can take over as master without disrupting the forwarding plane.

Question 46: What is the role of a P (Provider) router in an MPLS VPN architecture?

Performs label swap operations in the core (Correct answer)
Maintains VRF routing tables
Connects to customer CE routers
Exchanges VPNv4 routes with BGP

Correct answer: Performs label swap operations in the core

P routers are core MPLS routers that only perform label swap operations and have no knowledge of VPN or customer routes.

Question 47: What distinguishes the FIB and LFIB from one another?

FIB forwards full label paths while LFIB forwards only limited path information.
FIB forwards routing information while LFIB forwards label routing information.
FIB forwards IP packets while LFIB forwarded *labelled* IP packets. (Correct answer)
None of the above

Correct answer: FIB forwards IP packets while LFIB forwarded *labelled* IP packets.

The Forwarding Information Base (FIB) is used in traditional IP routing to forward IP packets based on their destination IP address. In contrast, the Label Forwarding Information Base (LFIB) is specific to MPLS and is used to forward packets that have an MPLS label attached. The LFIB contains instructions for label switching operations like swap, push, or pop, enabling faster forwarding decisions than traditional IP lookup.

Question 48: To connect to the Cisco switch, you would utilize a _______ cable.

RJ-45 crossover
RJ-48 straight through
UTP rolled cable (Correct answer)
RJ-45 Ethernet

Correct answer: UTP rolled cable

A UTP rolled cable, commonly known as a rollover or console cable, is specifically used to connect a computer's serial port (or a USB-to-serial adapter) to the console port of a Cisco switch or router. This cable allows direct, out-of-band access to the device's Command Line Interface (CLI) for initial configuration and troubleshooting. It has a specific pinout that "rolls over" the transmit and receive pins.

Question 49: In NFV, which component provides the virtual infrastructure resources such as compute, storage, and networking?

OSS/BSS
MANO
VNF
NFVI (Correct answer)

Correct answer: NFVI

The NFV Infrastructure (NFVI) encompasses the hardware and virtualization layers that host the VNFs.

Question 50: In order to return to the SETUP MODE or the ORIGINAL CONFIGURATION MODE,

Type reload and setup mode will resume after switch reboots
Power on and off the switch, pray that the initial configuration mode comes up
Type setup under PRIVILEDGE mode (Correct answer)
Type setup under CONFIGURATION mode

Correct answer: Type setup under PRIVILEDGE mode

To re-enter the initial setup mode on a Cisco device, you must be in privileged EXEC mode (indicated by the `#` prompt). From there, typing the `setup` command will launch the initial configuration dialog, allowing you to configure basic device settings as if it were a new device. This is useful for re-configuring fundamental parameters or reviewing initial setup options.

Question 51: What is the VXLAN Network Identifier (VNI) field size?

8 bits
24 bits (Correct answer)
32 bits
16 bits

Correct answer: 24 bits

The VNI is a 24-bit field, allowing up to 16 million unique overlay segments.

Question 52: What does setting `ip ospf priority 0` on an interface accomplish?

Increases the router's chance of becoming DR
Disables OSPF on that interface
Sets the OSPF route metric to zero
Makes the router ineligible to become DR or BDR (Correct answer)

Correct answer: Makes the router ineligible to become DR or BDR

Setting OSPF priority to 0 makes the router ineligible for DR/BDR election on that segment; only routers with priority ≥ 1 can be elected as DR or BDR.

Question 53: Which multicast address does VXLAN use for BUM traffic when flooding is enabled?

224.0.0.5
239.x.x.x (configured multicast group) (Correct answer)
224.0.0.1
255.255.255.255

Correct answer: 239.x.x.x (configured multicast group)

VXLAN BUM (Broadcast, Unknown-unicast, Multicast) traffic uses a configured multicast group address in the 239.x.x.x range.

Question 54: The difference(s) between using Telnet and SSH to remotely access a SWITCH's CLI is/are

Telnet requires rollover cable while SSH requires console cable
SSH encrypts data while Telnet does not (Correct answer)
Telnet uses port TCP port 23 while SSH uses TCP port 22 (Correct answer)
Telnet requires an IP to access the switch but SSH requires an IP and MAC address for security purposes

Correct answer: SSH encrypts data while Telnet does not

The primary difference between Telnet and SSH for remote access is security. SSH (Secure Shell) encrypts all data transmitted between the client and the switch, protecting sensitive information like passwords from eavesdropping, while Telnet sends data in plain text. Additionally, they use different default TCP ports: Telnet uses port 23, and SSH uses port 22, which is a key distinction for network configuration and firewall rules.

Question 55: Which MPLS plane contains label 3 routing and label exchange protocols?

Transport plane
Sarengeti plane
Data plane
Control plane (Correct answer)

Correct answer: Control plane

The control plane in MPLS is responsible for establishing and maintaining the label forwarding information. This includes running routing protocols (like OSPF, EIGRP, BGP) to learn network topology and IP routes, as well as label distribution protocols (like LDP or RSVP-TE) to exchange label mappings among Label Switching Routers (LSRs).

Question 56: Which action would be considered a design best-practice for the core layer in a three-tier hierarchical campus network design?

provide advanced network security features such as 802.1X, DHCP snooping, VACLs, and port security
provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence (Correct answer)
provide redundant aggregation for access layer devices and first-hop redundancy protocols such as VRRP
provide QoS prioritization services such as marking, queueing, and classification for critical network traffic

Correct answer: provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence

The action that would be considered a design best-practice for the core layer in a three-tier hierarchical campus network design is to "provide redundant Layer 3 point-to-point links between the core devices for more predictable and faster convergence."

Question 57: The vSmart controller is in charge of what in an SD-WAN deployment?

gather telemetry data from vEdge routers
onboard vEdge nodes into the SD-WAN fabric
manage, maintain, and gather configuration and status for nodes within the SD-WAN fabric
distribute security information for tunnel establishment between vEdge routers (Correct answer)

Correct answer: distribute security information for tunnel establishment between vEdge routers

In an SD-WAN (Software-Defined Wide Area Network) deployment, the vSmart controller is in charge of distributing security information for tunnel establishment between vEdge routers. The vSmart controller is a centralized management and control plane element in the SD-WAN architecture. It plays a critical role in overseeing the entire SD-WAN fabric and facilitating communication and coordination among the various SD-WAN devices, including vEdge routers, vBond orchestrators, and vManage network management system.

Question 58: What is the default MPLS label value reserved for the IPv4 explicit null label?

3
1
2
0 (Correct answer)

Correct answer: 0

Label value 0 is the IPv4 Explicit Null label, signaling the egress PE to pop the label and forward based on the IPv4 header.

Question 59: What kind of Wi-Fi encryption technique does pre-shared key (PSK) authentication normally employ?

SHA-1
MD5
DES
AES (Correct answer)

Correct answer: AES

To achieve the highest level of security, Advanced Encryption Standard (AES) is often employed with Pre-Shared Key (PSK) authentication.

Question 60: In NAT, what does PAT (Port Address Translation) allow?

Bidirectional NAT translation
Many internal hosts to share a single public IP by using unique source port numbers (Correct answer)
Static mapping of well-known ports
One-to-one IP mapping

Correct answer: Many internal hosts to share a single public IP by using unique source port numbers

PAT (also called NAT overload) allows many internal hosts to share one public IP by differentiating connections with unique source port numbers.

Question 61: What type of ACL can filter traffic based on both source and destination IP, and also TCP/UDP port numbers?

Standard ACL
Reflexive ACL
Extended ACL (Correct answer)
Named ACL

Correct answer: Extended ACL

Extended ACLs filter traffic based on source IP, destination IP, protocol, and Layer 4 port numbers.

Question 62: What is the primary role of a VTEP in a VXLAN network?

Encapsulate and decapsulate VXLAN packets (Correct answer)
Assign VNIs to hosts
Provide DHCP to overlay hosts
Route between VXLANs

Correct answer: Encapsulate and decapsulate VXLAN packets

A VXLAN Tunnel Endpoint (VTEP) performs the encapsulation of Layer 2 frames into VXLAN/UDP and the reverse decapsulation.

Question 63: Which NAT type maps one internal IP address to one unique external IP address on a one-to-one basis?

Policy NAT
PAT (NAT overload)
Dynamic NAT
Static NAT (Correct answer)

Correct answer: Static NAT

Static NAT creates a permanent one-to-one mapping between an inside local and inside global IP address.

Question 64: A network engineer needs to redistribute connected routes into BGP without advertising the loopback used for BGP peering. Which solution is BEST?

Disable BGP synchronization
Apply a route-map with a prefix-list to filter the loopback during redistribution (Correct answer)
Use 'network' statements for each connected prefix
Use 'redistribute connected' with no additional filtering

Correct answer: Apply a route-map with a prefix-list to filter the loopback during redistribution

A route-map referencing a prefix-list applied during redistribution selectively blocks the loopback prefix while advertising all other connected routes.

Question 65: What technology does LISP use to separate host identity from its location?

EID and RLOC (Correct answer)
MPLS and LDP
VRF and RD
VNI and VTEP

Correct answer: EID and RLOC

LISP separates the Endpoint Identifier (EID) from the Routing Locator (RLOC) to enable scalable mobility.

Question 66: Which protocol does Cisco DNA Center use to push configuration changes to network devices in a model-driven way?

SNMP v3
Telnet
RESTCONF/NETCONF (Correct answer)
SSHv1

Correct answer: RESTCONF/NETCONF

Cisco DNA Center uses NETCONF and RESTCONF over SSH/HTTPS to push YANG-modeled configurations to managed devices.

Question 67: What advantage does an on-premises deployment lack that a cloud infrastructure deployment offers?

storage capacity
supported systems
efficient scalability (Correct answer)
virtualization

Correct answer: efficient scalability

One advantage that a cloud infrastructure deployment offers, which an on-premises deployment lacks, is "efficient scalability."

Question 68: In EIGRP, what occurs when a router loses its Successor and no Feasible Successor exists in the topology table?

It goes into Passive state and waits for updates
It removes the route permanently and logs an error
It enters Active state and sends QUERY messages to all neighbors (Correct answer)
It immediately installs a default route

Correct answer: It enters Active state and sends QUERY messages to all neighbors

When no Feasible Successor exists, EIGRP transitions the route to Active state and sends QUERY messages to all neighbors seeking an alternative path to the destination.

Question 69: Applying an IPv6 ACL to an interface requires what Cisco IOS command?

ipv6 access-class
ipv6 access-list
ipv6 access-group
ipv6 traffic-filter (Correct answer)

Correct answer: ipv6 traffic-filter

You can apply an existing IPv6 ACL to an interface in either the in or out direction with the ipv6 traffic-filter command.

Question 70: What are the MPLS terms for adding and removing labels?

Plug and play
All of the above
Push and pop (Correct answer)
Wipe on wipe off

Correct answer: Push and pop

In MPLS, the terms 'push' and 'pop' describe the fundamental actions of adding and removing labels from packets. 'Push' refers to the process of adding a label to an IP packet as it enters the MPLS domain, typically performed by an ingress Label Edge Router. 'Pop' refers to the removal of a label from a packet, usually done by an egress LER or the penultimate hop router before the packet leaves the MPLS domain.

Question 71: Which MPLS label operation replaces an existing label with a new label?

Merge
Push
Pop
Swap (Correct answer)

Correct answer: Swap

The Swap operation replaces the top label in the MPLS stack with a new label at each transit LSR.

Question 72: In a ZBF configuration, which zone do router interfaces belong to by default?

no zone (no default) (Correct answer)
trust zone
outside zone
self zone

Correct answer: no zone (no default)

Router interfaces are not automatically placed in any zone; they must be explicitly assigned to a zone for ZBF to apply.

Question 73: Which plane in an SD-WAN architecture distributes OMP routing information between WAN Edge devices?

vEdge (data plane)
vManage (management plane)
vSmart (control plane) (Correct answer)
vBond (orchestration plane)

Correct answer: vSmart (control plane)

vSmart controllers form the control plane, running OMP to distribute routing, policy, and key information to WAN Edge routers.

Question 74: What is the default administrative distance of an OSPF inter-area (O IA) route in Cisco IOS?

120
110 (Correct answer)
115
90

Correct answer: 110

OSPF inter-area routes carry the same administrative distance of 110 as intra-area OSPF routes on Cisco IOS.

Question 75: What control plane protocol is employed between vSmart controllers and Cisco SD-WAN routers?

OMP (Correct answer)
TCP
UDP
BGP

Correct answer: OMP

The control plane protocol employed between vSmart controllers and Cisco SD-WAN routers is "OMP" (Overlay Management Protocol). OMP is a key control plane protocol in the Cisco SD-WAN (Software-Defined Wide Area Network) architecture. It is used for communication and coordination between the centralized vSmart controllers and the edge routers (also known as vEdge routers) deployed at remote locations.

Question 76: What is the purpose of Unicast Reverse Path Forwarding (uRPF) in strict mode?

Block multicast spoofing
Verify that the return path for a packet's source IP goes back out the same interface (Correct answer)
Encrypt unicast traffic
Rate-limit unicast flows

Correct answer: Verify that the return path for a packet's source IP goes back out the same interface

Strict uRPF drops packets if the best return path to the source IP is not through the same interface the packet arrived on, preventing IP spoofing.

Question 77: Which command configures a switch port as an 802.1Q trunk that allows all VLANs?

switchport trunk native vlan 1
switchport trunk encapsulation dot1q followed by switchport mode trunk (Correct answer)
switchport nonegotiate
switchport mode access

Correct answer: switchport trunk encapsulation dot1q followed by switchport mode trunk

You must first set the encapsulation to dot1q, then set the mode to trunk; without both commands the port does not become an active 802.1Q trunk.

Question 78: On a switch, debugging is enabled. For instance, I wish to debug the IP ICMP packet switch. Debugging would end if I would

Type no debug all
Reload the switch
All of the above (Correct answer)
Type no debug IP ICMP
Type undebug all

Correct answer: All of the above

All the listed methods can effectively stop debugging on a Cisco switch. Typing `no debug IP ICMP` specifically disables the debug for IP ICMP. `undebug all` or `no debug all` globally disables all active debugging sessions, and reloading the switch also clears all runtime configurations, including debugging, as debug commands are not persistent across reloads by default.

Question 79: Which 802.11 feature allows a wireless client to roam between APs without re-authenticating by caching PMK keys?

802.11v (BSS Transition Management)
802.11w (Management Frame Protection)
802.11k (Radio Resource Management)
802.11r (Fast BSS Transition) (Correct answer)

Correct answer: 802.11r (Fast BSS Transition)

802.11r Fast BSS Transition pre-caches PMK security keys on neighboring APs, dramatically reducing roaming latency.

Question 80: What is the purpose of Dynamic ARP Inspection (DAI)?

Prevent ARP spoofing by validating ARP packets against the DHCP snooping binding table (Correct answer)
Block ARP broadcasts
Encrypt ARP replies
Rate-limit ARP traffic

Correct answer: Prevent ARP spoofing by validating ARP packets against the DHCP snooping binding table

DAI validates ARP packets by checking the IP-to-MAC binding against the DHCP Snooping table, preventing ARP poisoning attacks.

Question 81: In MPLS, what does 'penultimate hop popping' (PHP) accomplish?

Merges two LSPs at the second-to-last hop
Swaps all labels at the penultimate router
Adds an extra label at the ingress PE
Removes the top label one hop before the egress (Correct answer)

Correct answer: Removes the top label one hop before the egress

PHP removes the outermost MPLS label at the penultimate LSR, reducing the egress PE's processing burden to a single lookup.

Question 82: Which EIGRP feature is commonly deployed on spoke routers in a hub-and-spoke WAN topology to limit query scope and prevent spoke-to-spoke transit routing?

EIGRP variance for unequal-cost load balancing
EIGRP route summarization
EIGRP stub routing (Correct answer)
EIGRP authentication

Correct answer: EIGRP stub routing

EIGRP stub routing designates a router as a stub, preventing it from being used as a transit path and causing hub routers to not send QUERY messages to stub spokes, reducing convergence time.

Question 83: In LISP, what does the ITR do when it cannot find an EID-to-RLOC mapping in its cache?

Sends the packet natively
Drops the packet
Sends a Map-Request to the Map Resolver (Correct answer)
Floods the packet

Correct answer: Sends a Map-Request to the Map Resolver

When the ITR has a cache miss, it sends a Map-Request to the Map Resolver to obtain the EID-to-RLOC mapping.

Question 84: Switch>? The command above will

List only available commands in the USER mode (Correct answer)
List only available commands in the CONFIGURATION mode
List all available commands on the switch
List only available commands in the ENABLE mode

Correct answer: List only available commands in the USER mode

In Cisco IOS CLI, typing `?` at the command prompt provides context-sensitive help. When you are in USER EXEC mode (indicated by the `Switch>` prompt), using `?` will display a list of all commands that are available and can be executed within that specific privilege level. This helps users discover valid commands for their current mode.

Question 85: What is the purpose of Control Plane Policing (CoPP) on a Cisco router?

Encrypt control plane traffic
Filter data plane traffic
Authenticate routing protocol neighbors
Rate-limit traffic destined to the route processor (Correct answer)

Correct answer: Rate-limit traffic destined to the route processor

CoPP protects the router's control plane by rate-limiting or dropping traffic directed to the route processor to prevent DoS attacks.

Question 86: What is the proper mapping between IP Prec 4's Flash Override and DSCP Codepoint?

AF22, AF23, AF43
AF42, AF43, EF
AF32, AF33, AF41
AF41, AF42, AF43 (Correct answer)

Correct answer: AF41, AF42, AF43

The only response that exclusively maps to Flash Override is AF41, AF42, and AF43.

Question 87: Which spanning tree port state forwards frames but does NOT learn MAC addresses?

Blocking
Listening (Correct answer)
Forwarding
Learning

Correct answer: Listening

In the Listening state, a port participates in spanning tree and can forward BPDUs, but it does not learn MAC addresses.

Question 88: Which wireless architecture mode has the WLC handle all real-time traffic forwarding?

Local mode (centralized) (Correct answer)
Autonomous mode
Monitor mode
FlexConnect mode

Correct answer: Local mode (centralized)

In local (centralized) mode, all AP traffic is tunneled via CAPWAP to the WLC, which forwards it to the wired network.

Question 89: Which OSPF network type does NOT elect a DR/BDR by default?

Non-broadcast
Broadcast
Point-to-multipoint
Point-to-point (Correct answer)

Correct answer: Point-to-point

Point-to-point OSPF network types do not elect a DR or BDR because there are only two routers on the link.

Question 90: Which two network issues warrant implementing Quality of Service (QoS) in a college network? (Select two.)

excess jitter (Correct answer)
misrouted network packets
bandwidth-related packet loss (Correct answer)
port flapping
duplicate IP addresses

Correct answer: excess jitter

QoS exists to protect real-time, delay-sensitive traffic like voice and video, and excess jitter (variation in packet delay) directly degrades those applications by causing choppy audio and frozen video—QoS prioritizes and smooths this traffic. Port flapping, misrouted packets, and duplicate IP addresses are Layer 1/2/3 connectivity or addressing faults that QoS cannot fix; they're solved by hardware, routing, or DHCP/IP management, not traffic prioritization.

Question 91: What does the 'ip helper-address' command accomplish on a Cisco router?

Configures a static NAT entry
Enables HSRP on the interface
Enables DHCP server functionality locally
Forwards UDP broadcast packets to a specified unicast address (Correct answer)

Correct answer: Forwards UDP broadcast packets to a specified unicast address

The ip helper-address command converts UDP broadcasts (including DHCP discover packets) into unicast packets forwarded to the specified server address.

Implementing and Operating Cisco Enterprise Network Core Technologies (350-401 ENCOR)

The Cisco ENCOR (350-401) exam certifies a candidate's knowledge of implementing core enterprise network technologies, including dual-stack (IPv4 and IPv6) architecture, virtualization, infrastructure, network assurance, security, and automation.

Questions

120 min

Time Limit

82%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cisco.com — Eligibility, renewal, score validity, test delivery, fees, time limit · verified Oct 2026