Cisco CCNP 350-401 ENCOR Practice Exam

• A. Layer 2 access
• B. three-tier
• C. two-tier
• D. routed access Correct answer

Cisco SD-Access uses a routed access design where every layer runs Layer 3 routing (no spanning tree). This enables the LISP/VXLAN fabric overlay to run on top and supports intent-based networking with automated policy provisioning via Cisco DNA Center. Traditional two-tier and three-tier hierarchical designs use Layer 2 access (STP), which is incompatible with SD-Access fabric requirements.

• A. list of ordered statements that define node configurations and authentication used within the SDWAN overlay
• B. Set of statements that defines how data is forwarded based on IP packet information and specific VPNs Correct answer
• C. Detailed database mapping several kinds of addresses with their corresponding location
• D. group of services tested to guarantee devices and links liveliness within the SD-WAN overlay

Data policies in Cisco SD-WAN define how data plane traffic is forwarded based on IP packet header fields (source/dest IP, protocol, port) and specific VPNs (VRF segments). They differ from control policies (which influence OMP routing tables) and AAR policies (application-aware routing). Data policies are centrally configured in vManage and distributed to WAN Edge routers via vSmart.

• A. excess jitter Correct answer
• B. bandwidth-related packet loss Correct answer
• C. misrouted network packets
• D. port flapping
• E. duplicate IP addresses

QoS is implemented in campus networks primarily to address: (1) bandwidth-related packet loss — when a link is congested, lower-priority traffic (bulk data) can be dropped to protect higher-priority traffic (voice, video); (2) excess jitter — variation in packet delay disrupts real-time applications (VoIP, video conferencing); QoS uses LLQ to minimize jitter for sensitive traffic. Port flapping is a physical layer issue; misrouted packets indicate a routing problem; duplicate IPs are an addressing issue. These are not QoS problems.

• A. The SD-WAN cloud is responsible for routing traffic within the 10.1.1.0/24 and 10.2.2.0/24 subnets.
• B. The SD-WAN cloud replaces the need for any routers at Site 1 and Site 2.
• C. The SD-WAN cloud provides a secure IPSec tunnel for data plane traffic between Site 1 and Site 2. Correct answer
• D. The SD-WAN cloud acts as a Layer 2 switch connecting R1 and R2.

Option C is correct because it accurately describes the role of the Cisco Catalyst SD-WAN solution in providing a secure IPSec tunnel for data plane traffic, which is a fundamental feature of SD-WAN technology. The other options are incorrect: Option D incorrectly states that the SD-WAN cloud acts as a Layer 2 switch, which is not the primary function of SD-WAN. Option A misrepresents the role of the SD-WAN cloud, as it does not specifically route traffic within those subnets but rather manages the overall WAN connectivity. Option B is incorrect because the SD-WAN solution does not eliminate the need for routers; it complements them by optimizing WAN traffic management.

• A. Apply the crypto map to the tunnel interface and change the tunnel mode to tunnel mode ipsec ipv4
• B. Create an IPsec profile, associate the transform-set. and apply the profile to the tunnel interface. Correct answer
• C. Remove the crypto map and modify the ACL to allow traffic between 10.10.0.0/24 to 10.20.0.0/24.
• D. Remove all configuration related to crypto map from R1 and R2 and eliminate the ACL Correct answer
• E. Create an IPsec profile, associate the transform-set ACL. and apply the profile to the tunnel interface

IPsec profile mode (used with GRE/DVTI tunnels) replaces crypto maps and ACLs. To convert: (1) Create an IPsec profile ('crypto ipsec profile NAME'), associate the transform set, and apply it to the tunnel interface ('tunnel protection ipsec profile NAME'). (2) Remove all crypto map configuration and the ACL that was used to define interesting traffic — with IPsec profiles, the GRE tunnel itself defines the protected traffic (all tunnel traffic is encrypted), so no separate ACL is needed.

• A. hardware pass-thru
• B. container
• C. Type 2 hypervisor Correct answer
• D. Type 1 hypervisor

A Type 2 hypervisor (hosted hypervisor) runs as an application on top of an existing host operating system. A Linux server that runs DNS and DHCP services (host OS functions) and also hosts virtual machines is using a Type 2 hypervisor — the hypervisor software runs on top of Linux. Type 1 (bare-metal) hypervisors run directly on hardware without a host OS. Examples of Type 2: VirtualBox, VMware Workstation, Parallels.

• A. Reset the VM
• B. Adjust the resource reservation limits Correct answer
• C. Reset the host
• D. Live migrate the VM to another host

Resource contention occurs when multiple VMs on the same host compete for limited CPU or memory. Adjusting resource reservation limits (setting minimum guaranteed resources for each VM) ensures each VM gets the resources it needs. Live migration moves a VM to another host (also valid for prolonged contention but adds complexity). Resetting VMs or hosts is disruptive and does not resolve the underlying resource allocation problem.

• A. VSW1, as it is a virtual switch connecting both VLANs.
• B. SW1, as it connects to the physical infrastructure.
• C. R1, as it is the router in the physical infrastructure. Correct answer
• D. VM1, as it is directly connected to VLAN 10.

Option C is correct because R1 is identified as the router in the physical infrastructure, which is typically responsible for routing traffic between different VLANs. Options A and B are incorrect because VSW1 and SW1 do not perform routing functions; they are switches that handle traffic within VLANs but do not route between them. Option D is incorrect because VM1 is only connected to VLAN 10 and does not facilitate routing between VLANs.

• A. Change the HSRP group configuration on the remote router to 1.
• B. Change the HSRP group configuration on the local router to 1.
• C. Change the HSRP virtual address on the remote router to 10.1.1.1.
• D. Change the HSRP virtual address on the local router to 10.1.1.1. Correct answer

The HSRP log 'DIFFVIP1' means the active router's virtual IP (10.1.1.1) differs from the local router's configured virtual IP (10.1.1.25). All HSRP members in the same group must use the same virtual IP. The local router is misconfigured — its virtual IP must be changed to match the active router: 'standby 1 ip 10.1.1.1.' The group number (1) is already consistent, so only the virtual IP on the local router needs changing.

• A. Router prefix lookups happens in CAM. MAC address table lookups happen in TCAM.
• B. The MAC address table is contained in CAM. ACL and QoS information is stored in TCAM. Correct answer
• C. The MAC address table supports partial matches. TCAM requires an exact match
• D. TCAM is used to make Layer 2 forwarding decisions CAM is used to build routing tables

The MAC address table (used for Layer 2 forwarding) is stored in CAM (Content-Addressable Memory) — a binary, exact-match memory. TCAM (Ternary CAM) adds a third state (don't-care/mask) enabling wildcard matching, making it suitable for ACLs (which use wildcard masks) and QoS markings (which use various match criteria). Router prefix lookups also use TCAM for longest-prefix matching. Layer 2 MAC lookups use CAM.

• A. Configure Root Guard on the trunk ports of SW1. Correct answer
• B. Use PAgP instead of LACP for EtherChannel on SW1.
• C. Enable PortFast on all trunk ports of SW1.
• D. Enable BPDU Guard on all ports of SW1.

Option A, 'Configure Root Guard on the trunk ports of SW1,' is correct because Root Guard is specifically designed to prevent a designated port from becoming the root bridge if a superior BPDU is received. This directly addresses the requirement to prevent SW1 from becoming the root bridge during topology changes. The other options are not suitable for this purpose: Option D (BPDU Guard) protects against loops but does not prevent root bridge election; Option C (PortFast) is used to speed up the transition of ports to the forwarding state but does not affect root bridge status; Option B (PAgP vs. LACP) pertains to link aggregation protocols and does not relate to spanning tree root bridge configuration.

• A. Router(config)# ip sla responder udp-echo 172.29.139.134 5000 Correct answer
• B. Router(config)# ip sla responder tcp-echo 172.29.139.134 5000
• C. Router(config)# ip sla responder udp-connect 172.29.139.134 5000
• D. Router(config)# ip sla responder tcp-connect 172.29.139.134 5000

IP SLA UDP jitter operations measure jitter, latency, and packet loss by sending UDP probe packets. The destination router must be configured as an IP SLA responder with 'ip sla responder udp-echo ipaddress <ip> port <port>' — this opens the UDP port and timestamps incoming probes accurately. The source router sends UDP probes to this endpoint and calculates jitter from the timestamps. TCP-based responders (tcp-connect, tcp-echo) and udp-connect cannot measure jitter. UDP echo responder is required for jitter measurement.

• A. monitor session 2 source interface gigabitethernet 0/3 rx monitor session 2 filter vlan 1 - 2 , 4 - 4094
• B. monitor session 2 source interface gigabitethernet 0/3 tx monitor session 2 filter vlan 1 - 2 , 4 - 4094
• C. monitor session 2 source interface gigabitethernet 0/3 tx monitor session 2 filter vlan 3 Correct answer
• D. monitor session 2 source interface gigabitethernet 0/3 rx monitor session 2 filter vlan 3

RSPAN (Remote SPAN) to capture ONLY outgoing (tx) VLAN 3 traffic from GigabitEthernet 0/3: (1) 'monitor session 2 source interface gigabitethernet 0/3 tx' — captures only egress (outgoing) traffic; (2) 'monitor session 2 filter vlan 3' — limits capture to VLAN 3 frames only, excluding all other VLANs. Using 'rx' would capture incoming. The filter 'vlan 1-2, 4-4094' would include everything EXCEPT VLAN 3 — the opposite of what's needed. Filter 'vlan 3' explicitly captures only VLAN 3 traffic.

• A. Use SNMP to check the interface status on SW1.
• B. Check syslog messages on R2 for interface errors.
• C. Perform a traceroute from PC1 to Server1 to check the path.
• D. Use ping from PC1 to Server1 to verify end-to-end connectivity. Correct answer

Option D, 'Use ping from PC1 to Server1 to verify end-to-end connectivity,' is the most effective tool for diagnosing connectivity issues between two endpoints. It directly tests whether the two devices can communicate over the network. Option A, 'Use SNMP to check the interface status on SW1,' is useful but does not directly verify connectivity between PC1 and Server1. Option C, 'Perform a traceroute from PC1 to Server1 to check the path,' can help identify where the failure occurs but is less direct than a ping test for confirming connectivity. Option B, 'Check syslog messages on R2 for interface errors,' is not relevant to the connection between PC1 and Server1, as it focuses on R2 rather than the direct path between the two endpoints.

• A. logging host 10.2.3.4 vrf mgmt transport tcp port 514
• B. logging host 10.2.3.4 vrf mgmt transport udp port 514
• C. logging host 10.2.3.4 vrf mgmt transport tcp port 6514 Correct answer
• D. logging host 10.2.3.4 vrf mgmt transport udp port 6514

Syslog over TLS (RFC 5425) uses TCP port 6514 as the IANA-assigned default port for secure, encrypted syslog transport. TLS requires TCP (not UDP) because TLS is a connection-oriented protocol providing reliability. Standard syslog uses UDP port 514 (unreliable, unencrypted). Syslog over TCP (without TLS) typically uses port 601. The correct configuration: 'logging host <ip> vrf <vrf> transport tcp port 6514' uses TCP (reliable) on the TLS syslog standard port.

• A. 802.1AE is built between the host and switch using the MKA protocol, which negotiates encryption keys based on the master session key from a successful 802.1X session Correct answer
• B. 802.1AE is built between the host and switch using the MKA protocol using keys generated via the Diffie-Hellman algorithm (anonymous encryption mode)
• C. 802.1AE provides encryption and authentication services
• D. 802.1AE is negotiated using Cisco AnyConnect NAM and the SAP protocol

MACsec (802.1AE) encrypts Layer 2 frames on a link. Between a host and switch, MACsec is established using the MKA (MACsec Key Agreement) protocol (IEEE 802.1X-2010). MKA negotiates and distributes encryption keys (SAKs — Secure Association Keys) derived from the MSK (Master Session Key) obtained from a successful 802.1X EAP authentication. Diffie-Hellman is NOT used (no anonymous key exchange). The SAP protocol is Cisco proprietary for older implementations. Standard MKA uses 802.1X-derived MSK for key negotiation.

• A. email phishing
• B. ransomware Correct answer
• C. SQL injection
• D. Microsoft Word macro attack Correct answer
• E. DDoS

Cisco AMP for Endpoints (AMP4E / Cisco Secure Endpoint) uses behavioral analysis, machine learning, and threat intelligence to detect and block: (1) ransomware — AMP's Malicious Activity Protection (MAP) engine detects ransomware-like file encryption behavior and terminates the process; (2) Microsoft Word macro attacks — AMP detects malicious macro execution and document-based exploits at the endpoint. DDoS and SQL injection are network-layer attacks (handled by firewalls/IPS, not AMP). Email phishing is a social engineering vector (handled by email security gateways).

• A. It enforces the use of a specific encoding format for NETCONF Correct answer
• B. It enforces configuration constraints. Correct answer
• C. It enforces configuration semantics.
• D. It collects statistical constraint analysis information.
• E. It enables multiple leaf statements to exist within a leaf list

YANG (Yet Another Next Generation) is a data modeling language designed for NETCONF/RESTCONF. Two key advantages: (1) It enforces configuration constraints — YANG defines mandatory/optional nodes, value ranges, pattern matching, and must/when conditions; violations are rejected by the NETCONF server. (2) It enforces the use of a specific encoding format for NETCONF — YANG models used with NETCONF are encoded in XML (the NETCONF transport mandates XML encoding). Note: YANG itself is encoding-agnostic (RESTCONF also supports JSON), but NETCONF specifically uses XML. 'Enforces configuration semantics' is also largely true but 'constraints' is the specific mechanism. A leaf-list does allow multiple leaf values (array of simple types).

• A. SaltStack uses the Ansible agent on the box, whereas Ansible uses a Telnet server on the box.
• B. SaltStack uses an API proxy agent to program Cisco boxes in agent mode, whereas Ansible uses a Telnet connection.
• C. SaltStack is constructed with minion, whereas Ansible is constructed with YAML Correct answer
• D. SaltStack uses SSH to interact with Cisco devices, whereas Ansible uses an event bus.

Key architectural difference between SaltStack and Ansible: SaltStack uses a master-minion architecture — a Salt Master controls Salt Minion agents installed on managed nodes (the minion is the agent). Ansible is agentless and uses YAML (playbooks are written in YAML) to define automation tasks. Ansible connects via SSH without requiring any agent installation. SaltStack uses ZeroMQ as its message bus (event bus) between master and minions, while Ansible uses SSH. The option correctly identifies that SaltStack's distinguishing feature is the minion agent, while Ansible's is YAML-based playbooks.

• A. It allows model developers to create custom data types
• B. It provides loops and conditionals to control now within models
• C. It structures data in an object-oriented fashion to promote model reuse Correct answer
• D. It is a Cisco proprietary language that models NETCONF data

YANG structures data hierarchically using modules, containers, lists, leafs, and leaf-lists in an object-oriented fashion — modules can import or include other modules (grouping statements allow reuse of common structures across models). This promotes model reuse and consistency. YANG is NOT Cisco proprietary — it is an IETF standard (RFC 6020 / RFC 7950). YANG does NOT support loops or conditionals (it's a data modeling language, not a programming language). YANG does allow typedef for custom derived data types, but model reuse via modularity is its most notable architectural feature.