Cisco CCNP Enterprise ENCOR (350-401)

Question 1

Two Catalyst switches, DSW1 and ASW1, are connected by a manually configured 802.1q trunk. Users in VLAN 1 on ASW1 can reach the network, but the switches log repeated '%CDP-4-NATIVE_VLAN_MISMATCH' messages every 60 seconds. On DSW1 the trunk port shows 'switchport trunk native vlan 99'; on ASW1 the same port shows 'switchport trunk native vlan 1'. Tagged VLANs 10 and 20 pass traffic correctly. What is the effect of this condition, and how should you resolve it?

Accepted Answer

Untagged frames can be leaked between VLAN 99 and VLAN 1, creating a potential VLAN-hopping risk; configure the same native VLAN on both trunk ends.

Answer

The trunk will go down; set both ends to 'switchport mode dynamic auto' so DTP renegotiates the native VLAN automatically.

Answer

Tagged VLANs 10 and 20 will be pruned; enable VTP pruning on both switches to restore connectivity.

Answer

The mismatch only affects CDP and is purely cosmetic; disable CDP on the trunk ports to stop the log messages with no other action needed.

Question 2

A network engineer configures AAA on a Catalyst switch to authenticate administrative logins against a RADIUS server. During a maintenance window the RADIUS server becomes unreachable, and the engineer is now completely locked out of the console and VTY lines even though a local username exists. The relevant configuration is: 'aaa authentication login default group radius'. Which change ensures the engineer can still log in with the local database when RADIUS is unreachable?

Accepted Answer

aaa authentication login default group radius local

Answer

aaa authentication login default local group radius

Answer

aaa authentication login default group radius none

Answer

aaa authentication login default enable group radius

Question 3

A network administrator wants junior technicians to log into a Catalyst switch and be able to run all show commands and clear counters, but NOT enter global configuration mode or reload the device. The administrator prefers a solution local to the device that avoids assigning each command an individual privilege level. Which approach best meets this requirement?

Accepted Answer

Configure a CLI parser view with 'parser view TECH' and associate only the permitted commands, then require Role-Based CLI access at login

Answer

Set 'privilege exec level 15 show' so technicians receive privilege level 15 automatically on login

Answer

Create a local user with 'username tech privilege 1' and rely on the default privilege 1 restrictions

Answer

Enable 'aaa authorization exec default none' so all commands are permitted without restriction

Question 4

A network automation team must choose an orchestration tool for a fleet of 400 Cisco IOS-XE routers. The security team has a strict policy prohibiting the installation of any persistent third-party software daemons on the network devices, and the devices already have SSH enabled for management. Which characteristic of an agentless orchestration tool best satisfies these requirements?

Accepted Answer

It connects to devices over existing protocols such as SSH or NETCONF without installing software on the managed nodes.

Answer

It requires a client process to be installed on each managed device to pull configuration from a central master.

Answer

It relies on a compiled binary agent that periodically checks in with a policy server every 30 minutes.

Answer

It mandates a dedicated management VLAN and a proprietary transport protocol on every managed router.

Question 5

A network engineer wants to proactively identify recurring client connectivity issues across a large campus without manually parsing individual device logs. Management asks for a solution that uses machine learning to establish baselines and flag anomalies against normal behavior. Which Cisco Catalyst Center (formerly Cisco DNA Center) capability specifically provides this AI-driven baseline comparison and anomaly detection?

Accepted Answer

AI Network Analytics with dynamic baselining and anomaly detection in Assurance

Answer

The Command Runner tool to push show commands to devices in bulk

Answer

Template Editor with day-N configuration provisioning

Answer

Plug and Play (PnP) for zero-touch device onboarding

Question 6

A network engineer is writing a Python script that calls the Cisco Catalyst Center Intent API endpoint GET /dna/intent/api/v1/network-device to retrieve the full inventory. The lab has 850 managed devices, but each API response only returns the first 500 devices. The engineer must retrieve all devices without changing the endpoint. What is the most appropriate way to obtain the remaining records?

Accepted Answer

Add the query parameters limit and offset to page through the results, incrementing offset on each subsequent request until all devices are returned

Answer

Change the Accept header to application/yang-data+json so the server returns the complete dataset in one response

Answer

Re-issue the request with an X-Auth-Token that has administrator privileges to remove the record cap

Answer

Switch the HTTP verb from GET to POST so the body can request more than 500 devices at once

Question 7

A network engineer is troubleshooting intermittent PPP authentication failures on a router that terminates hundreds of dialer sessions. Enabling 'debug ppp authentication' globally would overwhelm the console with output from all sessions. The engineer wants to capture debug output only for traffic related to interface Dialer1 without impacting other sessions. Which set of commands correctly restricts the debug output to only that interface?

Accepted Answer

Configure 'debug condition interface Dialer1' first, then enable 'debug ppp authentication'

Answer

Enable 'debug ppp authentication' first, then apply 'logging filter interface Dialer1'

Answer

Apply an access list matching Dialer1 traffic and reference it with 'debug ip packet detail'

Answer

Configure 'debug interface Dialer1 all' which automatically limits all debugs to that interface

Question 8

A network engineer notices that a Catalyst switch experiences high CPU utilization during a burst of ARP and routing protocol traffic directed at the device itself, causing management sessions to time out. The engineer wants to rate-limit traffic destined to the router's control plane without affecting transit data traffic. Which feature should be implemented to accomplish this?

Accepted Answer

Control Plane Policing (CoPP) applied to the control-plane interface

Answer

A port-based ACL applied inbound on all physical data interfaces

Answer

Storm control configured on the switch's access ports

Answer

QoS shaping applied to the WAN uplink egress queue

Question 9

A network engineer is hardening a Catalyst 9300 switch. Corporate policy requires that only the management subnet 10.50.10.0/24 be permitted to reach the device management plane, and that any denied management attempt be recorded for the SOC. The engineer has already configured SSHv2. Which additional configuration correctly restricts and logs remote management access to the VTY lines?

Accepted Answer

Create a standard ACL permitting 10.50.10.0/24 with a trailing 'deny any log' entry, then apply it under line vty 0 15 using 'access-class' inbound

Answer

Create an extended ACL permitting TCP from 10.50.10.0/24 to the device with a final 'deny ip any any log' entry, then apply it to a physical interface with 'ip access-group' inbound

Answer

Apply the standard ACL to line vty 0 15 using 'access-class' outbound so only the management subnet can be reached from the switch

Answer

Configure 'management-interface' under the VTY lines and reference the management subnet with 'permit 10.50.10.0 0.0.0.255' without any logging keyword

Question 10

During a security audit of a new Catalyst 9300 switch, you are asked to reduce the device's attack surface before it is placed into production. The switch currently has its factory-default configuration for management services. Which action most directly hardens the management plane by removing a plaintext, legacy remote-access protocol that transmits credentials in clear text?

Accepted Answer

Configure 'transport input ssh' on the VTY lines to disable Telnet access

Answer

Enable 'service password-encryption' globally to obscure passwords in the running config

Answer

Apply an access-class ACL to the VTY lines to restrict source IP ranges

Answer

Configure 'login block-for' to throttle repeated failed login attempts

Question 11

A network engineer connects two Catalyst switches with a single link and expects an 802.1Q trunk to form dynamically. On both switches the interface is configured with 'switchport mode dynamic auto' and no other switchport commands. After the link comes up, VLAN traffic from non-native VLANs is not passing between the switches. 'show interfaces switchport' on both sides shows the operational mode as 'static access'. What is the cause of this behavior?

Accepted Answer

Both interfaces are in dynamic auto mode, so neither actively initiates DTP negotiation and the link defaults to access mode.

Answer

DTP frames are being blocked because the native VLAN does not match on the two switches.

Answer

Dynamic auto requires 'switchport nonegotiate' on at least one side before a trunk can form.

Answer

The link formed an access port because dynamic auto always overrides dynamic desirable when both are configured.

Question 12

You are configuring eBGP between two directly connected routers, R1 and R2. R1 uses 'neighbor 10.1.1.2 remote-as 65002' pointing at R2's directly connected interface IP, and R2 uses 'neighbor 10.1.1.1 remote-as 65001'. However, an engineer changed R1 to peer with R2's Loopback0 address (192.168.2.2) instead, using 'neighbor 192.168.2.2 remote-as 65002' with a static route to reach the loopback. The session fails to establish. What is the MOST likely cause, and what corrects it?

Accepted Answer

eBGP packets are sent with a TTL of 1; peering to a loopback adds a hop, so 'neighbor 192.168.2.2 ebgp-multihop 2' (and matching update-source) is required

Answer

eBGP requires both peers to be in the same AS; change R2 to remote-as 65001 to match R1

Answer

eBGP does not support loopback peering under any circumstances; the only fix is to revert to the directly connected interface IPs

Answer

The loopback must be advertised via an IGP first; adding 'network 192.168.2.2' under BGP will restore the adjacency

Question 13

A network engineer manages an eBGP edge router (AS 65010) that advertises the 203.0.113.0/24 prefix to two directly connected upstream ISPs: ISP-A (AS 64500) via GigabitEthernet0/0 and ISP-B (AS 64501) via GigabitEthernet0/1. The company wants ISP-A to be the primary path for all INBOUND traffic to 203.0.113.0/24, using ISP-B only if the ISP-A link fails. The engineer cannot influence the ISPs' local policies. Which action taken on the edge router will best achieve this goal?

Accepted Answer

Apply an outbound route-map to the ISP-B neighbor that prepends the local AS multiple times to the AS-path of 203.0.113.0/24

Answer

Apply an outbound route-map to the ISP-A neighbor that sets a higher local-preference for 203.0.113.0/24

Answer

Apply an inbound route-map to the ISP-A neighbor that sets a higher weight for received routes

Answer

Apply an outbound route-map to the ISP-B neighbor that sets a lower MED for 203.0.113.0/24

Question 14

Two directly connected routers, R1 (AS 65010) and R2 (AS 65020), are configured for eBGP peering using their physical interface IP addresses. The link is up and both routers can ping each other's interface, but the BGP session cycles between Idle and Active and never reaches Established. On R1 you see the neighbor configured with 'neighbor 10.0.0.2 update-source Loopback0'. R1's Loopback0 is 1.1.1.1/32 and R2 is peering to 10.0.0.1 (R1's physical interface). What is the most likely cause of the session failure?

Accepted Answer

R1 is sourcing BGP packets from Loopback0 (1.1.1.1), but R2 expects the session from 10.0.0.1, so the incoming packets do not match R2's configured neighbor address

Answer

eBGP requires the 'ebgp-multihop 2' command whenever routers are directly connected on the same subnet

Answer

The two routers are in different autonomous systems, which prevents any eBGP session from forming without a route reflector

Answer

BGP synchronization is enabled by default and must be disabled before the neighbor can reach Established

Question 15

An engineer configures eBGP between two directly connected routers, R1 (AS 100) and R2 (AS 200), using the interface IP addresses on the shared 10.1.1.0/30 link. R2 advertises 192.168.50.0/24 to R1. On R1, the BGP table shows the 192.168.50.0/24 prefix as valid but with a status of 'inaccessible' and it is not installed in the routing table. The neighbor is in the Established state and other prefixes are learned fine. What is the MOST likely cause?

Accepted Answer

R1 has no route to reach the BGP next-hop address advertised for 192.168.50.0/24, so the recursive lookup fails

Answer

The eBGP session requires the 'ebgp-multihop' command because the routers are directly connected

Answer

R2 must be configured with 'next-hop-self' for the eBGP session to install the prefix

Answer

The prefix is being filtered by an inbound distribute-list on R1

Question 16

A network engineer writes an EEM applet named GATHER-STATE that should collect 'show tech-support' output and write it to flash whenever the engineer manually invokes it during a troubleshooting session, rather than being triggered automatically by any system event. Which event detector configuration statement should be used in the applet?

Accepted Answer

event none

Answer

event timer watchdog time 60

Answer

event syslog pattern ".*UPDOWN.*"

Answer

event cli pattern "show tech-support" sync yes

Question 17

A network engineer needs an EEM applet on a core switch that automatically bounces GigabitEthernet1/0/24 whenever the interface goes into an err-disabled state. The engineer wants the applet to trigger off the syslog message that is generated at that moment and then issue a shutdown followed by a no shutdown on the interface. Which EEM configuration correctly accomplishes this?

Accepted Answer

event manager applet RECOVER / event syslog pattern "%PM-4-ERR_DISABLE.*Gi1/0/24" / action 1.0 cli command "enable" / action 2.0 cli command "configure terminal" / action 3.0 cli command "interface Gi1/0/24" / action 4.0 cli command "shutdown" / action 5.0 cli command "no shutdown"

Answer

event manager applet RECOVER / event timer watchdog time 60 / action 1.0 cli command "interface Gi1/0/24" / action 2.0 cli command "shutdown" / action 3.0 cli command "no shutdown"

Answer

event manager applet RECOVER / event snmp oid 1.3.6.1.2.1.2.2.1.7 get-type exact entry-op eq entry-val 2 / action 1.0 cli command "interface Gi1/0/24" / action 2.0 cli command "no shutdown"

Answer

event manager applet RECOVER / event cli pattern "shutdown" sync yes / action 1.0 cli command "interface Gi1/0/24" / action 2.0 cli command "no shutdown"

Question 18

A network engineer wants an IOS device to automatically archive its running configuration to a TFTP server every day at 2:00 AM without any manual intervention or external scheduler. Which EEM applet configuration correctly accomplishes this?

Accepted Answer

event manager applet DAILY-BACKUP with 'event timer cron cron-entry "0 2 * * *"' followed by 'action 1.0 cli command "copy running-config tftp://10.1.1.5/backup.cfg"'

Answer

event manager applet DAILY-BACKUP with 'event syslog pattern "CONFIG"' followed by 'action 1.0 cli command "copy running-config tftp://10.1.1.5/backup.cfg"'

Answer

event manager applet DAILY-BACKUP with 'event timer watchdog time 7200' followed by 'action 1.0 cli command "write memory"'

Answer

event manager applet DAILY-BACKUP with 'event none' followed by 'action 1.0 cli command "copy running-config tftp://10.1.1.5/backup.cfg"'

Question 19

A network engineer notices that a route in the EIGRP topology table shows no feasible successor after the primary path failed. The router sends queries to its neighbors and waits for replies before installing a new path. Which statement best explains why this behavior occurs and its consequence?

Accepted Answer

No neighbor met the feasibility condition, so DUAL places the route into the active state and queries neighbors, risking a stuck-in-active (SIA) condition if replies are delayed.

Answer

The router lost its adjacency, so it must rebuild the neighbor table using hello packets before any route can be reused.

Answer

The successor's reported distance was lower than the feasible distance, which caused DUAL to immediately promote the backup path without querying.

Answer

EIGRP summarization at the boundary removed the backup route, forcing the router to rely on a floating static route instead.

Question 20

A network engineer wants R1 to load-balance traffic across two paths toward 10.20.0.0/24. The successor route has a feasible distance of 3072000, and a feasible successor exists with a reported distance of 2560000 and a feasible distance of 4096000. Currently only the successor path is installed in the routing table. Which action will cause EIGRP to install BOTH paths for unequal-cost load balancing?

Accepted Answer

Configure 'variance 2' under the EIGRP process on R1

Answer

Configure 'maximum-paths 2' under the EIGRP process on R1

Answer

Configure 'variance 1' under the EIGRP process on R1

Answer

Lower the EIGRP hello and hold timers on both interfaces

Question 21

A network engineer is documenting the differences between EIGRP and OSPF for a design review. Both protocols are being evaluated for a campus WAN with links of varying bandwidth. Which statement correctly describes a fundamental difference in how these two protocols select the best path?

Accepted Answer

EIGRP calculates its metric using bandwidth and delay by default, while OSPF uses a cost derived from a reference bandwidth divided by interface bandwidth.

Answer

OSPF uses a composite metric based on bandwidth and delay by default, while EIGRP uses cumulative cost derived only from interface bandwidth.

Answer

Both EIGRP and OSPF use hop count as the primary metric, but EIGRP allows a maximum of 255 hops while OSPF allows unlimited hops.

Answer

OSPF supports unequal-cost load balancing natively with the variance command, while EIGRP only supports equal-cost load balancing.

Question 22

A network engineer is evaluating whether to deploy EIGRP or OSPF in an enterprise campus. A key requirement is the fastest possible reconvergence after a primary path failure WITHOUT any recomputation delay, provided a precomputed loop-free backup path already exists in the topology. Which statement correctly compares how each protocol meets this requirement?

Accepted Answer

EIGRP can install a feasible successor immediately from its topology table, avoiding recomputation, whereas OSPF must run the SPF algorithm to recalculate the shortest-path tree.

Answer

OSPF installs a precomputed backup automatically from its link-state database, while EIGRP must rerun the DUAL algorithm for every failure.

Answer

Both protocols use precomputed backup paths identically, so convergence behavior is the same regardless of which is chosen.

Answer

EIGRP must flood a full topology update and rerun DUAL on all routers before installing any backup, making OSPF's SPF faster in this case.

Question 23

A network engineer is documenting the differences between EIGRP and OSPF for a design review. A senior architect asks how each protocol determines the best path and reacts to topology changes. Which statement accurately compares the two protocols?

Accepted Answer

EIGRP uses a composite metric (bandwidth and delay by default) and can use feasible successors for immediate failover, while OSPF calculates a cost based on interface bandwidth and runs the SPF algorithm to build its tree.

Answer

Both EIGRP and OSPF use the Dijkstra SPF algorithm, but EIGRP applies a composite metric while OSPF uses hop count as its metric.

Answer

OSPF maintains feasible successors as precomputed backup routes, whereas EIGRP must recompute the entire topology on every link failure.

Answer

EIGRP requires a hierarchical area design with a backbone area, while OSPF is a flat distance-vector protocol with no area concept.

Question 24

A network engineer is comparing routing protocol behavior on two identical routers. On Router-A running EIGRP and Router-B running OSPF, both connect the campus to remote branch networks. The engineer needs route summarization applied close to the source networks to minimize routing table size. Which statement correctly describes a fundamental difference between where these two protocols allow summarization to be configured?

Accepted Answer

EIGRP supports summarization on any interface of any router, while OSPF only supports summarization on ABRs (inter-area) and ASBRs (external routes).

Answer

OSPF supports summarization on any interface of any router, while EIGRP only allows summarization at area boundaries.

Answer

Both protocols only allow summarization on backbone-connected routers and cannot summarize on access-layer interfaces.

Answer

EIGRP can only summarize on the router originating the network, while OSPF summarizes automatically on every router by default.

Question 25

A network engineer is hardening a Catalyst switch and wants to protect privileged EXEC mode. The running configuration currently contains both 'enable password Cisco123' and 'enable secret Str0ngP@ss'. When the engineer types 'enable' at the user EXEC prompt, which behavior occurs, and why?

Accepted Answer

The switch accepts only 'Str0ngP@ss' because 'enable secret' takes precedence and is stored as an MD5 hash, overriding the weaker 'enable password'.

Answer

The switch accepts either 'Cisco123' or 'Str0ngP@ss' because both credentials remain valid for privileged access.

Answer

The switch accepts only 'Cisco123' because 'enable password' is checked first in the configuration order.

Answer

The switch rejects all access to privileged mode until one of the two conflicting commands is removed.

Question 26

A regional office is being redesigned. It currently has 3 access switches connecting to a pair of distribution switches, which in turn connect to a separate pair of core switches. The network team notes that the entire site fits in a single building with fewer than 400 users, and they want to reduce cost, cabling complexity, and the number of managed devices while maintaining redundancy. Which enterprise campus design change best satisfies these requirements?

Accepted Answer

Migrate to a collapsed core design by merging the core and distribution functions into a single redundant layer

Answer

Add a second set of core switches to build a full three-tier hierarchy with dedicated aggregation

Answer

Convert all access switches to Layer 3 routed ports connecting directly to the core, removing the distribution layer

Answer

Replace the distribution switches with a single non-redundant core switch to reduce device count

Question 27

A network engineer needs to capture traffic from a distribution switch in Building A and forward that mirrored traffic to a packet analyzer that resides on a subnet reachable only through a routed Layer 3 path in the data center. The source and destination are in different IP subnets separated by multiple router hops. Which monitoring feature must the engineer configure to accomplish this?

Accepted Answer

ERSPAN, which encapsulates the mirrored traffic in GRE and routes it to the destination IP

Answer

Local SPAN with the source and destination ports on the same switch

Answer

RSPAN using a dedicated reflector VLAN trunked across the Layer 2 domain

Answer

Flexible NetFlow exporting flow records to the analyzer via UDP

Question 28

A network engineer is configuring ERSPAN on a Catalyst switch to send a copy of traffic from GigabitEthernet1/0/10 to a monitoring appliance located across a routed Layer 3 network at IP address 10.50.50.100. The engineer has entered the following on the source switch:

monitor session 1 type erspan-source
 source interface Gi1/0/10
 destination
  erspan-id 100
  ip address 10.50.50.100

After committing the configuration, no traffic is arriving at the monitoring appliance. Which additional configuration step under the destination sub-mode is required for the ERSPAN session to become operational?

Accepted Answer

Configure the 'origin ip address' with a local routable source IP for the GRE-encapsulated ERSPAN packets

Answer

Configure a 'filter vlan' statement to restrict which VLANs are captured on the source interface

Answer

Change the session type to 'erspan-destination' so the switch can forward the mirrored frames

Answer

Add a 'source remote ip address 10.50.50.100' command so the switch learns the appliance route

Question 29

Two switches, SW1 and SW2, are cabled together on ports Gi1/0/1 and Gi1/0/2 to form a Layer 2 EtherChannel. On both switches, the channel-group is configured with 'channel-group 1 mode passive'. After the configuration, the port-channel interface never comes up and 'show etherchannel summary' shows the ports in an independent (I) state. What is the cause and the correct fix?

Accepted Answer

Both sides are using LACP passive mode, so neither initiates negotiation; change at least one side to 'mode active'.

Answer

PAgP and LACP are being mixed; change both sides to 'mode desirable'.

Answer

The ports must be configured as trunks first; add 'switchport mode trunk' to bring the channel up.

Answer

Passive mode requires 'mode on' on the peer; change SW2 to 'mode on' to force the bundle.

Question 30

A network engineer is configuring Flexible NetFlow on a Catalyst switch to export traffic statistics to a collector at 10.20.30.40. They have already created a flow record named REC-APP with match and collect fields, and a flow exporter named EXP-COLL pointing to the collector. Traffic is flowing through GigabitEthernet1/0/1, but no flow data appears at the collector. Which additional configuration step is required to complete the deployment?

Accepted Answer

Create a flow monitor that references both the flow record and the flow exporter, then apply the flow monitor to GigabitEthernet1/0/1 with the 'ip flow monitor' command

Answer

Apply the flow exporter EXP-COLL directly to GigabitEthernet1/0/1 using the 'ip flow exporter' interface command

Answer

Bind the flow record REC-APP directly to GigabitEthernet1/0/1 using the 'ip flow record' interface command

Answer

Enable 'ip flow ingress' on GigabitEthernet1/0/1 to activate the traditional NetFlow cache using the existing exporter

Question 31

A network engineer needs to run multiple isolated routing tables on a single Cisco IOS-XE router so that three separate customer networks can share the same physical hardware without any routing information overlapping. No overlay tunneling or MPLS is available. Which data-path virtualization technology should the engineer implement to achieve control-plane separation on the router?

Accepted Answer

Virtual Routing and Forwarding (VRF) instances

Answer

Cisco Virtual Device Contexts (VDCs)

Answer

Stackwise Virtual (SVL)

Answer

Hot Standby Router Protocol (HSRP) groups

Question 32

A network engineer must connect two remote enterprise sites over a service-provider IP backbone that does not support the customer's dynamic routing protocol natively. The engineer needs a virtual point-to-point overlay that can carry OSPF adjacencies and multicast traffic between the sites' routers, but data confidentiality is being handled separately by an application-layer solution. Which device virtualization / data-path technology BEST meets these requirements with the least configuration overhead?

Accepted Answer

A generic routing encapsulation (GRE) tunnel between the two site routers

Answer

An IPsec tunnel in transport mode between the two site routers

Answer

VRF-lite with 802.1Q subinterfaces on the WAN link

Answer

A Layer 2 VPLS pseudowire provisioned by the enterprise

Question 33

A network engineer configures a GRE tunnel between two branch routers. The tunnel source is set to a loopback interface, and the tunnel destination is the remote loopback. After configuration, the tunnel repeatedly flaps and the logs show '%TUN-5-RECURDOWN: Tunnel0 temporarily disabled due to recursive routing'. The engineer confirms both physical WAN links are up and the loopbacks are reachable via a dynamic routing protocol. What is the most likely cause of this issue?

Accepted Answer

The route to the tunnel destination is being learned through the tunnel interface itself, creating a routing loop

Answer

The tunnel MTU is set higher than the physical interface MTU, causing fragmentation

Answer

The GRE keepalive interval is mismatched between the two routers

Answer

IPsec has not been applied to protect the GRE tunnel traffic

Question 34

A network engineer must connect two branch routers over the public Internet. The design requires that OSPF adjacencies and multicast video streams traverse the tunnel, while all traffic must also be encrypted for confidentiality. Which single tunnel technology, used alone, satisfies BOTH the multicast/routing-protocol requirement AND the encryption requirement?

Accepted Answer

GRE over IPsec (GRE encapsulated inside an IPsec tunnel)

Answer

A standalone GRE tunnel without any additional protection

Answer

A native IPsec tunnel-mode SA in isolation (no GRE)

Answer

An 802.1Q VLAN trunk extended across the Internet

Question 35

Two distribution switches run HSRP for VLAN 20. SW1 is configured with priority 150 and preempt; SW2 uses the default priority and preempt. SW1 is the active router. The network team wants SW1 to give up the active role automatically if its WAN uplink (GigabitEthernet0/1) goes down, so traffic fails over to SW2 which has an independent WAN path. Which configuration on SW1 accomplishes this?

Accepted Answer

standby 20 track GigabitEthernet0/1 decrement 60

Answer

standby 20 priority 90 preempt delay minimum 60

Answer

standby 20 timers 1 3 on GigabitEthernet0/1

Answer

standby 20 authentication md5 key-string TRACK60

Question 36

Two distribution switches, DSW1 and DSW2, share HSRP group 10 for VLAN 20's default gateway. DSW1 is configured with priority 150 and DSW2 with the default priority. During maintenance, DSW1 was reloaded; when it came back online, users noticed DSW2 remained the active router even though DSW1 has the higher priority. What must be configured on DSW1 to make it reclaim the active role automatically when it recovers?

Accepted Answer

standby 10 preempt

Answer

standby 10 priority 150 on DSW2 as well

Answer

standby 10 timers 1 3

Answer

standby version 2

Question 37

A network engineer is documenting the first-hop redundancy design for a distribution layer. The two distribution switches must present a single default-gateway IP to hosts. The design mandates the use of an open-standard protocol (not Cisco-proprietary) and must support a preemption behavior that is enabled by default so the highest-priority router automatically becomes the forwarding router when it recovers. Which protocol meets both requirements?

Accepted Answer

VRRP

Answer

HSRP version 2

Answer

GLBP

Answer

HSRP version 1

Question 38

A financial trading floor uses a Layer 2 switch to distribute a market-data multicast stream to a few subscribed servers. Network engineers notice that the multicast traffic is flooding to every port in the VLAN, including hosts that never joined the group, saturating uninvolved links. Routing and PIM are operating correctly on the upstream router. Which action on the access switch will restrict the multicast frames to only the ports with interested receivers?

Accepted Answer

Enable IGMP snooping on the VLAN so the switch learns which ports have receivers from their IGMP membership reports

Answer

Configure PIM sparse-mode on the switch's SVI to build a shared tree toward the receivers

Answer

Enable an IGMP querier only on the upstream router and remove the switch from the multicast path

Answer

Apply storm control on the receiver ports to police the multicast rate below the link capacity

Question 39

A network engineer wants a static default route to a primary ISP to automatically fail over to a backup ISP when the primary next-hop becomes unreachable, even though the physical interface to the primary ISP stays up. The engineer configures an IP SLA ICMP echo operation targeting an address across the primary ISP link. Which additional configuration is REQUIRED to make the floating static route react to the IP SLA results?

Accepted Answer

Associate the primary static route with a track object that is tied to the IP SLA operation's reachability, and configure the backup route with a higher administrative distance

Answer

Configure the IP SLA operation with a lower administrative distance than the backup route so it takes precedence automatically

Answer

Apply the IP SLA operation directly to the primary interface using the 'ip sla monitor interface' command so the route is withdrawn on failure

Answer

Set both static routes to the same administrative distance and let the IP SLA operation load-balance between them

Question 40

A network engineer must proactively measure the quality of a VoIP path across the WAN between two Catalyst routers. Management wants continuous reporting of one-way latency, jitter, packet loss, and an estimated voice quality (MOS) score without deploying any external probes. Which IP SLA operation should the engineer configure to satisfy all of these requirements?

Accepted Answer

IP SLA UDP jitter operation using the codec keyword

Answer

IP SLA ICMP echo operation with a 100-byte payload

Answer

IP SLA TCP connect operation to the VoIP gateway port

Answer

IP SLA HTTP operation targeting the call manager web service

Question 41

A network engineer is building a JSON payload to POST a list of two VLANs to the Catalyst Center API. Each VLAN must include a numeric 'id' and a string 'name'. Which of the following is a syntactically valid JSON document that meets these requirements?

Accepted Answer

{ "vlans": [ { "id": 10, "name": "data" }, { "id": 20, "name": "voice" } ] }

Answer

{ "vlans": [ { "id": '10', "name": data }, { "id": '20', "name": voice } ] }

Answer

{ "vlans": ( { "id": 10, "name": "data" }, { "id": 20, "name": "voice" } ) }

Answer

{ "vlans": [ { "id": 10, "name": "data", }, { "id": 20, "name": "voice", } ] }

Question 42

A network architect is documenting the difference between LISP and VXLAN in an SD-Access fabric for a design review. A junior engineer asks which statement correctly describes the fundamental roles these two technologies play in the fabric architecture. Which statement is accurate?

Accepted Answer

LISP provides the control-plane function for endpoint (EID)-to-locator mapping, while VXLAN provides the data-plane encapsulation that carries traffic across the underlay.

Answer

VXLAN provides the control-plane mapping of endpoints to fabric edge nodes, while LISP encapsulates the user traffic across the underlay.

Answer

Both LISP and VXLAN are data-plane encapsulation protocols, and the fabric selects one per VLAN based on MTU requirements.

Answer

LISP encrypts the fabric traffic while VXLAN authenticates endpoints before they are added to the mapping database.

Question 43

A security engineer must encrypt all traffic on the point-to-point uplink between two Catalyst switches inside the data center to prevent an attacker who taps the cable from reading or modifying frames. The solution must operate at Layer 2, provide line-rate encryption in hardware, and authenticate the two switches to each other. Which technology should the engineer deploy on this switch-to-switch link?

Accepted Answer

MACsec (802.1AE) with an MKA pre-shared key session

Answer

A GRE tunnel between the two switch SVIs

Answer

IPsec transport mode applied to the uplink subnet

Answer

Control Plane Policing (CoPP) with an encryption service policy

Question 44

Two switches, SW1 and SW2, are connected by an 802.1Q trunk and both are configured for MST. All VLANs are allowed on the trunk, but you notice that SW1 treats SW2 as a boundary and runs a separate MST instance toward it rather than forming a single common MST region. You confirm both switches have 'spanning-tree mode mst' and identical instance-to-VLAN mappings. Which additional configuration mismatch most likely prevents them from being in the same MST region?

Accepted Answer

The MST region names or revision numbers differ between SW1 and SW2

Answer

The switches use different bridge priorities for instance 0

Answer

Root guard is enabled on SW1's trunk interface

Answer

The trunk is using dynamic (DTP) negotiation instead of a static trunk

Question 45

A network engineer configures PAT on a router named EDGE so that all hosts on the inside LAN (192.168.10.0/24) can reach the Internet using the single public IP assigned to interface GigabitEthernet0/1 (203.0.113.5). Internal users report they cannot browse the Internet. The engineer runs 'show ip nat translations' and sees no entries. The current configuration is:

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
interface GigabitEthernet0/1
 ip address 203.0.113.5 255.255.255.248

ip access-list standard NAT_HOSTS
 permit 192.168.10.0 0.0.0.255
ip nat inside source list NAT_HOSTS interface GigabitEthernet0/1 overload

Which action will fix the problem?

Accepted Answer

Add the 'ip nat outside' command to interface GigabitEthernet0/1

Answer

Change the ACL to an extended access list matching TCP and UDP traffic

Answer

Remove the 'overload' keyword because it prevents dynamic translations

Answer

Add a static NAT entry mapping 192.168.10.0 to 203.0.113.5

Question 46

A network automation engineer is standardizing programmable interfaces on new Catalyst switches. The security team requires all management traffic to use encrypted transport, and the automation platform will use HTTP-based tooling (curl, Postman) for ad-hoc configuration changes. The engineer must enable the correct protocol and confirm the transport it uses. Which statement correctly describes RESTCONF on a Cisco IOS XE device?

Accepted Answer

RESTCONF uses HTTPS over TCP port 443 by default and exposes YANG data models through RESTful HTTP verbs

Answer

RESTCONF uses SSH over TCP port 830 and requires a candidate datastore commit for every change

Answer

RESTCONF uses SNMPv3 over UDP port 161 to retrieve and modify YANG-modeled configuration

Answer

RESTCONF uses NETCONF-over-TLS on TCP port 6513 and only supports XML-encoded payloads

Question 47

A network engineer is automating configuration changes on an IOS XE router using NETCONF over SSH on port 830. The engineer wants the ability to stage a batch of configuration changes, validate them, and then apply them all at once as a single transaction — with the option to discard the staged changes if validation fails. Which NETCONF capability must the device support to accomplish this workflow?

Accepted Answer

The :candidate capability, editing a candidate datastore and using <commit> to apply changes

Answer

The :writable-running capability, editing the running datastore directly with <edit-config>

Answer

The :startup capability, copying running to startup with <copy-config>

Answer

The :rollback-on-error option within a single <edit-config> to the running datastore

Question 48

A network engineer configures Flexible NetFlow on a WAN edge router to monitor a long-lived backup transfer that runs for over 30 minutes. The engineer notices that the collector does not receive any flow records for this transfer until it finishes, making real-time capacity monitoring impossible. The flow monitor uses the default cache settings. Which action allows the collector to receive periodic updates about the ongoing transfer while it is still in progress?

Accepted Answer

Lower the active flow timeout on the flow monitor cache so long-lived flows are exported at regular intervals

Answer

Lower the inactive flow timeout on the flow monitor cache to force idle flows to be exported sooner

Answer

Change the cache type to permanent so entries are never removed from the flow cache

Answer

Add the flow direction as a key field in the flow record to trigger bidirectional export

Question 49

A network architect is designing the security framework for a new enterprise campus. Management wants to ensure that if a perimeter firewall is compromised, additional controls still protect internal resources. The architect proposes stacking multiple independent security controls at the perimeter, distribution, and access layers so that no single failure exposes critical assets. Which network security design principle does this approach represent?

Accepted Answer

Defense in depth

Answer

Least privilege

Answer

Separation of duties

Answer

Security through obscurity

Question 50

A network engineer is bringing up a new Cisco Nexus 9000 switch. During initial setup, the engineer assigns the mgmt0 interface an IP address and later notices that all management traffic to the device's mgmt0 interface is fully isolated from the data-plane routing table, even though no explicit VRF configuration was entered. Which statement correctly explains this behavior?

Accepted Answer

The mgmt0 interface is automatically placed in the dedicated 'management' VRF, isolating out-of-band traffic from the default routing table.

Answer

The mgmt0 interface uses a separate VDC by default, which prevents any communication with data-plane interfaces.

Answer

NX-OS applies an implicit ACL to mgmt0 that drops all traffic destined for data-plane subnets.

Answer

The mgmt0 interface operates in the default VRF but is placed in a private VLAN to enforce isolation.

Question 51

A data center architect is comparing overlay encapsulation options for a new multitenant fabric. The team wants a Layer 2 overlay that transports tenant frames over a Layer 3 underlay, uses UDP as the transport protocol so that ECMP load balancing across the underlay can be achieved via source-port entropy, and provides a 24-bit segment identifier for tenant isolation. Which encapsulation technology meets ALL of these requirements?

Accepted Answer

VXLAN, which encapsulates the original Layer 2 frame in a UDP packet with a 24-bit VNI

Answer

NVGRE, which encapsulates the frame in GRE with a 24-bit Tenant Network Identifier

Answer

802.1Q, which tags the frame with a 12-bit VLAN ID for tenant separation

Answer

MPLS, which pushes a 20-bit label stack to isolate tenant traffic

Question 52

An ASBR redistributes static routes into OSPF using the default configuration. A remote router several hops away receives two paths to the same redistributed prefix through two different ABRs, but it always selects the same next hop regardless of the internal cost to reach each ABR. A network engineer wants the remote router to instead prefer the path with the lowest total cost, accounting for the internal OSPF cost to reach the ASBR. Which action achieves this?

Accepted Answer

Redistribute the routes as OSPF External Type 1 (E1) by adding the metric-type 1 keyword

Answer

Increase the OSPF reference bandwidth on the remote router

Answer

Configure the routes as OSPF External Type 2 (E2) with a higher seed metric

Answer

Enable OSPF summarization on both ABRs with the area range command

Question 53

A network engineer manages an OSPF network with a backbone (area 0) and two normal areas (area 10 and area 20). The 10.50.0.0/24 subnet exists in area 10. Management wants to prevent this specific inter-area route from being advertised into area 20, while all other inter-area routes must continue to flow normally. On which device and using which mechanism should the engineer implement this filter?

Accepted Answer

On the ABR between area 0 and area 20, apply an area 20 filter-list using a prefix-list in the 'in' direction

Answer

On the ABR between area 0 and area 10, apply a distribute-list with an access-list on the LSA Type 1 flooding

Answer

On any internal router in area 20, apply a distribute-list in the inbound direction to drop the route from the routing table

Answer

Convert area 20 to a totally stubby area so that only a default route is injected

Question 54

Two routers, R1 and R2, are connected back-to-back over a single Ethernet link in OSPF area 0. An engineer notices that adjacency forms correctly, but a DR and BDR election occurs on the segment, adding unnecessary election overhead and a slightly slower convergence when the link flaps. The engineer wants to eliminate the DR/BDR election on this point-to-point Ethernet link while keeping OSPF adjacency intact. What should be configured on both interfaces?

Accepted Answer

ip ospf network point-to-point

Answer

ip ospf priority 0

Answer

ip ospf network non-broadcast

Answer

ip ospf network broadcast

Question 55

A network engineer configures OSPFv2 on a distribution switch. The LAN segment facing end-user workstations should still advertise its subnet into OSPF, but no OSPF adjacency should ever form on that segment. Meanwhile, the point-to-point link to the core router must form a full adjacency. After applying 'passive-interface default' under the OSPF process, the engineer notices the core adjacency is stuck in INIT and never reaches FULL. What is the correct action to restore the core adjacency while keeping the user LAN passive?

Accepted Answer

Enter 'no passive-interface' for the interface facing the core router, and leave the user LAN interface passive.

Answer

Remove the LAN subnet from the OSPF 'network' statement so it is no longer advertised.

Answer

Change the OSPF network type on the core interface to broadcast so hellos are exchanged.

Answer

Increase the OSPF hello and dead timers on the core interface to match the passive default.

Question 56

An engineer redistributes 20 connected /24 subnets (10.50.0.0/24 through 10.50.19.0/24) from a static-route source into OSPF on an ASBR. The neighboring routers now carry 20 individual external LSAs, increasing their LSDB size. The engineer wants to advertise a single 10.50.0.0/19 summary into the OSPF domain from this ASBR. Which command accomplishes this?

Accepted Answer

summary-address 10.50.0.0 255.255.224.0 under the OSPF process

Answer

area 0 range 10.50.0.0 255.255.224.0 under the OSPF process

Answer

ip summary-address ospf 1 10.50.0.0 255.255.224.0 on the egress interface

Answer

area 0 range 10.50.0.0 255.255.224.0 not-advertise under the OSPF process

Question 57

An enterprise OSPF domain has an ABR connecting the backbone (area 0) to a stub-like area (area 20) that contains an ASBR redistributing static routes from a partner network. The design team wants area 20 to allow its locally originated external routes to be advertised into the rest of the OSPF domain, but block Type 5 LSAs from other ASBRs from entering area 20. Which area type must be configured on area 20 to meet both requirements?

Accepted Answer

Not-so-stubby area (NSSA)

Answer

Totally stubby area

Answer

Standard stub area

Answer

Backbone area

Question 58

An engineer manages an OSPFv2 network where area 10 contains the subnets 172.16.16.0/24, 172.16.17.0/24, 172.16.18.0/24, and 172.16.19.0/24. To reduce the size of the routing table in area 0, the engineer wants R1 (the ABR connecting area 10 to area 0) to advertise a single summary route for these subnets into the backbone. Which command should be applied on R1 to accomplish this?

Accepted Answer

area 10 range 172.16.16.0 255.255.252.0 (under router ospf)

Answer

summary-address 172.16.16.0 255.255.252.0 (under router ospf)

Answer

area 0 range 172.16.16.0 255.255.252.0 (under router ospf)

Answer

ip summary-address ospf 172.16.16.0 255.255.252.0 (under the area 10 interface)

Question 59

Two routers, R1 and R2, are directly connected over a point-to-point serial link running OSPFv3 for IPv6. The adjacency is stuck in EXSTART/EXCHANGE. R1's interface MTU is set to 1500 and R2's interface MTU is set to 1400. Both interfaces are in the same area and the interface network types match. Which action will bring the adjacency to FULL?

Accepted Answer

Match the MTU values on both interfaces, or configure 'ipv6 ospf mtu-ignore' on both interfaces

Answer

Change the OSPFv3 network type to broadcast on both interfaces

Answer

Ensure both routers use the same OSPFv3 process ID

Answer

Configure matching OSPFv3 authentication keys on both interfaces

Question 60

A network engineer must route traffic from the 10.1.10.0/24 subnet (a guest VLAN) out a low-cost broadband link on GigabitEthernet0/1, while all other traffic continues to follow the routing table toward the primary MPLS link. The engineer configures a route-map matching an ACL for the guest subnet with a 'set ip next-hop 203.0.113.2' statement and applies it inbound on the VLAN's SVI. Which statement best describes how this policy-based routing behaves?

Accepted Answer

Traffic sourced from 10.1.10.0/24 is forwarded to 203.0.113.2 regardless of the destination-based routing table entry, while traffic not matched by the ACL is routed normally.

Answer

All traffic entering the SVI is forwarded to 203.0.113.2 because PBR overrides the routing table for every packet on the interface.

Answer

The policy is ignored because route-maps for PBR must be applied outbound on the egress interface GigabitEthernet0/1.

Answer

Traffic from 10.1.10.0/24 is dropped unless a matching static route to 203.0.113.2 already exists in the routing table.

Question 61

A network engineer is deploying multicast for a video streaming application across an enterprise campus using PIM Sparse Mode. When the first receiver on a LAN sends an IGMP join for group 239.10.20.30, its last-hop router builds a multicast forwarding entry and sends a PIM Join upstream. Toward which device does this initial PIM Join travel to establish the shared distribution tree?

Accepted Answer

Toward the Rendezvous Point (RP) for the group

Answer

Toward the source's directly connected first-hop router (the DR)

Answer

Toward the IGMP querier elected on the receiver's LAN

Answer

Toward the multicast source using a shortest-path (S,G) join

Question 62

A network engineer writes a Python script to parse a Cisco Catalyst Center API response. The JSON response is loaded into a variable named 'data' with this structure: {"response": [{"hostname": "edge-sw1", "managementIpAddress": "10.1.1.5", "reachabilityStatus": "Reachable"}]}. Which line of Python correctly assigns the management IP address of the first device to a variable called 'ip'?

Accepted Answer

ip = data["response"][0]["managementIpAddress"]

Answer

ip = data["response"]["managementIpAddress"][0]

Answer

ip = data.response.managementIpAddress

Answer

ip = data[0]["response"]["managementIpAddress"]

Question 63

A network engineer writes the following Python snippet to print the hostname of each device returned by a Catalyst Center inventory query:

devices = [
  {"hostname": "core-sw1", "role": "CORE"},
  {"hostname": "acc-sw2", "role": "ACCESS"},
  {"hostname": "acc-sw3", "role": "ACCESS"}
]

for d in devices:
    print(d["hostname"])

What output does this script produce?

Accepted Answer

core-sw1
acc-sw2
acc-sw3

Answer

{"hostname": "core-sw1", "role": "CORE"} repeated three times

Answer

CORE
ACCESS
ACCESS

Answer

A KeyError because 'hostname' is not a valid dictionary key

Question 64

A network engineer writes a Python script that uses the requests library to pull device inventory from Cisco Catalyst Center. The relevant lines are:

resp = requests.get(url, headers=hdr, verify=False)
    if resp.status_code == 200:
        data = resp.json()
        for d in data['response']:
            print(d['hostname'])

When run, the script prints nothing and raises no exception. The engineer confirms the token is valid and the URL is correct. Inspecting the raw response shows an HTTP 200 with a body of {"response": []}. What does this behavior indicate?

Accepted Answer

The request succeeded but the API returned an empty result set, so the for loop had nothing to iterate over.

Answer

The status_code comparison failed because requests returns status codes as strings, not integers.

Answer

The token is expired; Catalyst Center silently returns 200 with an empty body when authentication fails.

Answer

resp.json() raised a decoding error that was suppressed, so data was never populated.

Exam domain	Exam weight	Practice
Architecture	15%	Practice this topic
Virtualization	10%	Practice this topic
Infrastructure	30%	Practice this topic
Network Assurance	10%	Practice this topic
Security	20%	Practice this topic
Automation and Artificial Intelligence	15%	Practice this topic

Cisco CCNP Enterprise ENCOR (350-401) (350-401) practice exam & study guide

Start studying 350-401

All 350-401 study resources

350-401 exam domains

Sample 350-401 questions

Key 350-401 terms

350-401 frequently asked questions

Architecture (15%)

Virtualization (10%)

Infrastructure (30%)

Network Assurance (10%)

Security (20%)

Automation and Artificial Intelligence (15%)