Free CCNP ENCOR Practice Test: 350-401 v1.2

Answer: A two-tier collapsed core, where distribution also acts as core

A two-tier collapsed core merges the core and distribution layers into one redundant pair, which suits a single building where a separate core adds cost without adding much value. A three-tier design is the tempting textbook answer, but a dedicated core pays off in large campuses with many distribution blocks, not in a site with six access switches.

Answer: Every leaf uplinks to every spine, so any two leaves are one spine apart

In spine-and-leaf, each leaf has an uplink to every spine and servers attach to the leaves, so traffic between servers on different leaves always crosses exactly one spine. That predictable hop count, with equal-cost paths through every spine, is why the design suits east-west traffic; spines do not interconnect, so a spine mesh is the wrong picture.

Answer: SSO together with NSF and NSF-aware neighbors

Stateful switchover keeps the standby supervisor fully initialized with synchronized state, and nonstop forwarding keeps traffic moving on the last known CEF entries while NSF-aware neighbors help the routing protocols restart gracefully. RPR is the tempting near miss, but its standby is only partly booted, so a switchover takes longer and resets the line cards; FHRPs and StackWise Virtual work between separate devices, not between supervisors in one chassis.

Answer: SD-WAN Controller

The SD-WAN Controller, formerly vSmart, is the control plane: it peers with every WAN Edge over OMP, reflects routes and TLOCs, distributes data plane keys and applies centralized policy. The Validator, formerly vBond, is tempting because it is also a controller, but its role is orchestration, authenticating devices, pointing them at the Controllers and helping with NAT traversal.

Answer: Over IPsec tunnels between TLOCs, with BFD probes on each tunnel

User traffic travels in IPsec tunnels built directly between TLOCs on the WAN Edge routers, and BFD runs inside every tunnel to detect failures and measure loss, latency and jitter for application-aware routing. DTLS is the tempting choice because WAN Edges do use DTLS or TLS, but only for control connections to the Controllers and Manager, which never carry user data.

Answer: Application-aware routing with an SLA class

Application-aware routing compares live BFD measurements on each tunnel against an SLA class and steers matching traffic, such as voice, onto a transport that meets the loss, latency and jitter targets. TLOC extension is tempting because it involves transports, but it only lets one router use a circuit that terminates on its neighbor at the same site, and it makes no SLA decisions.

Answer: LISP

SD-Access uses LISP in the control plane: edge nodes register their endpoints (EIDs) with the control plane node, which acts as map server and map resolver and returns the RLOC of the edge node in front of each endpoint. VXLAN is the tempting answer because it is also part of SD-Access, but it is the data plane encapsulation that carries traffic once the location is known.

Answer: Border node

Border nodes are the gateway between the fabric and everything outside it, handing off virtual networks to external routers, typically with VRF-lite and BGP, and a border can also use a Layer 2 handoff to join a fabric subnet to a VLAN on the traditional campus during migration. The fabric edge node is tempting because traffic enters the fabric there, but it connects endpoints such as user devices, phones and printers, not external networks.

Answer: VOICE is served first up to 10 percent, and the rest splits 40:60

priority percent 10 makes VOICE a strict-priority queue that is always served first and, during congestion, is limited to 10 percent of the interface rate, while bandwidth remaining percent divides whatever bandwidth is left after priority traffic. If VOICE uses its full 10 percent, CRITICAL gets 40 percent of the remaining 90, about 36 percent of the link; reading the remaining percentages as shares of the full link is the common mistake.

Answer: ESXi is type 1 and VirtualBox is type 2

A type 1, or bare-metal, hypervisor such as ESXi runs directly on the hardware, while a type 2, or hosted, hypervisor such as VirtualBox runs as an application on top of a host operating system. ESXi having its own management interface does not make it type 2; what matters is whether a general-purpose host OS sits underneath the hypervisor.

Answer: It joins VRF GUEST, and its address is removed and must be re-entered

Assigning an interface to a VRF removes its existing IP addresses, and IOS XE prints a message saying the addresses were removed due to enabling the VRF, so the address must be configured again. Assuming the address carries over is the classic mistake that leaves the interface with no address and the VRF with no connected route.

Answer: R1 learns its route to the tunnel destination through Tunnel0

Recursive routing occurs when the best route to the tunnel destination points out the tunnel itself, so the router would have to send the encapsulated packet back into the same tunnel; IOS detects the loop and disables the tunnel. The fix is to keep the tunnel endpoint networks out of the routing protocol that runs over the tunnel, or to make the physical path preferred; an MTU mismatch causes fragmentation problems, not this message.

Answer: Run GRE over IPsec so OSPF multicast is carried and then encrypted

A crypto map protects only unicast traffic that matches its crypto ACL, so OSPF hellos sent to 224.0.0.5 are never carried. GRE wraps the multicast hellos and updates in unicast packets between the tunnel endpoints, and IPsec then encrypts those GRE packets; adding multicast addresses to the crypto ACL is tempting, but a crypto map still cannot carry multicast.

Answer: It sends a Map-Request to the map resolver for the matching RLOC

On a map-cache miss, the ITR sends a Map-Request to the map resolver, which passes it through the mapping system to the map server and on to the ETR that registered the EID, and the answer comes back as a Map-Reply with the RLOC to encapsulate toward. Map-Register is the tempting distractor, but ETRs send it to register their own EIDs with the map server, not to look up a destination.

Answer: A 24-bit VNI carried in a UDP-encapsulated header

VXLAN wraps the original Ethernet frame in a VXLAN header, UDP with destination port 4789, IP and an outer Ethernet header, and its 24-bit VXLAN network identifier allows about 16 million segments compared with 4,094 usable VLANs. Because the outer packet is ordinary routed IP, the underlay can be a Layer 3 fabric with equal-cost paths instead of a spanning tree domain.

Answer: An access link, because neither port starts trunk negotiation

Dynamic auto only responds to DTP requests and never sends them first, so two auto ports stay in access mode; at least one side must be dynamic desirable or trunk for a trunk to form. Assuming that two negotiable ports will agree on a trunk is the common trap, and the safer production practice is switchport mode trunk with switchport nonegotiate on both ends.

Answer: The command replaced the allowed list, so only VLAN 40 now crosses

switchport trunk allowed vlan followed by a bare list overwrites the existing list, so the trunk now carries only VLAN 40; the correct command was switchport trunk allowed vlan add 40. An STP topology change is tempting because the outage followed a change, but under RSTP it would settle within seconds and would not single out the existing VLANs.

Answer: Gi1/0/3 has trunk or VLAN settings that differ from the others

The lowercase s flag means suspended, which the switch applies when a member's configuration, such as its allowed VLAN list, native VLAN or trunking mode, does not match the port channel, and the log usually names the mismatched attribute. Hot standby is the tempting choice, but LACP marks those ports with H, while P means bundled and D means down.

Answer: The port moves to root-inconsistent and stops forwarding

Root guard places a port that receives a superior BPDU into the root-inconsistent state, which blocks it, and the port recovers on its own once the superior BPDUs stop arriving. Err-disabled is the tempting answer, but that is BPDU guard's behavior, which needs a manual shutdown and no shutdown or errdisable recovery to come back.

Answer: They see each other as different regions, so the link is a boundary

Switches share an MST region only when the region name, revision number and VLAN-to-instance mapping all match exactly, so a different revision puts them in separate regions and the link between them becomes a region boundary. Treating the revision as a cosmetic label is the trap; across a boundary only the CIST interacts, so the per-instance topology the design intended is lost.

Answer: EIGRP, with variance 2 so the second path is also installed

EIGRP supports unequal-cost load balancing: variance 2 installs any feasible successor whose metric is less than twice the best metric, so the 51,200 path, below 61,440, joins the 30,720 path and traffic is shared in inverse proportion to the metrics. OSPF load balances only across equal-cost paths, so matching the costs would split traffic evenly rather than in proportion to the links.

Answer: Only a default route injected by the ABR as a Type 3 LSA

area 20 stub no-summary makes area 20 totally stubby, so the ABR blocks Type 3 summaries and Type 5 externals and injects a single default route as a Type 3 LSA, while routers still learn every route inside area 20. A plain stub area is the tempting answer, but it still passes inter-area Type 3 routes along with the default and blocks only the externals.

Answer: Interface MTU

OSPF compares the interface MTU carried in the database description packets exchanged during EXSTART and EXCHANGE, so a mismatch stalls the adjacency there; the fix is to align the MTUs, with ip ospf mtu-ignore as a workaround. Mismatched timers, area IDs or authentication are tempting, but those are checked in hello packets, so the routers would never discover each other at all.

Answer: area 1 range 10.1.0.0 255.255.240.0

area range summarizes inter-area routes on an ABR, and the area number is the area that holds the component routes, so area 1 range 10.1.0.0 255.255.240.0 advertises 10.1.0.0 to 10.1.15.255 as one /20. summary-address is the tempting look-alike, but under OSPF it summarizes external routes on an ASBR, not inter-area routes on an ABR.

Answer: The route leaves this router's table, but the LSA stays and floods

Every router in an area must hold an identical link-state database, so an inbound distribute-list under OSPF only stops the matching route from being installed in the local routing table; the LSA stays in the database and is still flooded to neighbors. To keep a prefix out of an area, filter Type 3 LSAs on the ABR with area filter-list or use an area range with not-advertise.

Answer: Set a 32-bit router ID manually under router ospfv3 1

OSPFv3 still uses a 32-bit router ID written in dotted-decimal form, and it can only choose one automatically from an IPv4 address on the router, so an IPv6-only router needs a command such as router-id 1.1.1.1 under router ospfv3 1. Adding an IPv6 loopback is the tempting fix, but a 128-bit IPv6 address cannot serve as the 32-bit router ID.

Answer: Path B, because its local preference is higher

The Cisco best path algorithm checks weight first, then local preference, where higher wins, and only later AS_PATH length, so path B's local preference of 200 decides the result before AS_PATH is considered. AS_PATH length is the tempting answer because path A is clearly shorter, but it is compared only when weight and local preference tie.

Answer: The session is Established and 12 prefixes have been received

When State/PfxRcd shows a number instead of a state name, the session is Established and the number is how many prefixes have been received from that neighbor, while Up/Down shows how long the session has been in that state. Reading the number as sent prefixes is the trap; show ip bgp neighbors 198.51.100.1 advertised-routes is the command that lists what R1 sent.

Answer: With ip policy route-map on the LAN interface where guest traffic arrives

Policy-based routing acts on packets as they are received, so ip policy route-map goes on the ingress interface facing the guest subnet, and packets that do not match the route map are routed normally. ip local policy route-map is the tempting option, but it applies only to traffic the router itself generates, not to transit traffic from hosts.

Answer: Stratum 3

A device that synchronizes to a server takes the server's stratum plus one, so R2 at stratum 4 is synchronized to a stratum 3 source. Stratum 1 is the tempting guess for any upstream server, but it is reserved for devices attached directly to a reference clock such as GPS, and every hop away from that clock adds one.

Answer: ip nat inside source static tcp 192.168.10.20 443 203.0.113.5 443

ip nat inside source static tcp lists the inside local address and port first and the inside global address and port second, so outside clients that connect to 203.0.113.5 on 443 are translated to the server. Reversing the two addresses is the tempting mistake, and the overload statement is dynamic PAT for outbound traffic, which never creates a fixed entry that outside hosts can reach.

Answer: R2, because R1 does not have preempt

HSRP does not preempt by default, so once R2 took over during the reload it stays active even though R1 returns with a higher priority; standby 10 preempt on R1 would let it reclaim the role. R1 is the tempting answer because higher priority wins elections, but without preemption an active router is never displaced, unlike VRRP, which preempts by default.

Answer: The packets fail the RPF check, arriving on the wrong interface

PIM forwards a multicast packet only if it arrives on the interface the router would use to reach the source, the reverse path forwarding check, so packets on G0/0/2 are dropped while unicast routing points to G0/0/1. The fix is to align the multicast path with unicast routing or add a static mroute; MSDP is tempting, but it shares active source information between RPs and does not change the RPF interface.

Answer: Levels 0 to 4, warnings and more severe

Syslog severity runs from 0, emergencies, to 7, debugging, and setting a level sends that level plus every more severe one, so logging trap warnings sends levels 0 to 4. Levels 4 to 7 is the common mistake, because lower numbers are more severe and it is the less severe messages that get filtered out.

Answer: Match fields are key fields that define a flow; collect fields are tallied per flow

In a flow record, match statements are key fields: packets with the same values belong to the same flow, and any new combination creates a new flow entry. collect statements are non-key fields, such as byte and packet counters, gathered for each flow; treating match as a packet filter is the tempting mistake, because match lines decide how traffic is grouped into flows, not whether it is monitored.

Answer: ERSPAN

ERSPAN encapsulates the mirrored frames in GRE so they can be routed across a Layer 3 network to a remote destination. RSPAN is the tempting choice because it is also remote, but it carries the copies in a dedicated VLAN and needs a Layer 2 path end to end; Flexible NetFlow exports flow summaries, not the packets themselves.

Answer: The tracked route is withdrawn and the AD 250 route takes over

When the probe fails, track 10 goes down and the static default through 203.0.113.1 is removed from the routing table, so the floating static with administrative distance 250 through 192.0.2.1 is installed instead. Without the track keyword the primary route would stay in place as long as its exit interface was up, which is exactly the silent failure IP SLA tracking is meant to catch.

Answer: AI Network Analytics with dynamic baselines

AI Network Analytics, an AI-powered assurance workflow in Catalyst Center, uses machine learning to build dynamic baselines for each network and raises AI-driven issues when key indicators move outside the expected range. Template Hub and Software Image Management are traditional workflows that apply configuration and software consistently, which is valuable but does nothing to decide what counts as abnormal behavior.

Answer: TCP 830

IOS XE runs NETCONF over SSH on the IANA-assigned TCP port 830 by default, and the client and device exchange hello messages listing their capabilities before any RPCs are sent. TCP 22 is tempting because NETCONF uses SSH, but that port belongs to the normal CLI SSH service, and TCP 443 is where RESTCONF listens over HTTPS.

Answer: Type 7 is a reversible encoding that free tools decode instantly

Type 7, produced by service password-encryption, is a weak reversible cipher, so anyone who sees the configuration can recover the password in seconds; the fix is username netops privilege 15 algorithm-type scrypt secret, which stores a type 9 hash. An MD5 hash is the tempting answer, but that is type 5, a salted one-way hash, whereas type 7 can be reversed outright.

Answer: R1 rejects the login without checking the local database

AAA moves to the next method in the list only when the current one returns an error, such as no response from the server; a FAIL reply from a reachable TACACS+ server ends the attempt and the login is denied. Trying the local database is the tempting answer, but that only happens when TACACS+ cannot be reached, which is what makes the local account a break-glass fallback.

Answer: TACACS+, because it separates the AAA functions over TCP 49

TACACS+ handles authentication, authorization and accounting as separate exchanges over TCP port 49 and encrypts the entire packet body, which makes per-command authorization and accounting practical for device administration. RADIUS is tempting because it is widely deployed, but it combines authentication and authorization in one exchange and encrypts only the password, which is why it is mainly used for network access such as 802.1X.

Answer: access-class MGMT-ONLY in under line vty 0 15

access-class applied inbound on the vty lines filters who can open a remote session to the device itself and leaves traffic passing through the switch untouched. Applying the ACL with ip access-group on interfaces is the tempting answer, but it would filter every packet crossing those interfaces, including user traffic, and ip access-group is not a valid command on vty lines.

Answer: The explicit deny also blocks neighbor discovery the implicit rules allow

Every IPv6 ACL ends with implicit permits for neighbor solicitations and advertisements followed by an implicit deny, so an explicit deny ipv6 any any placed before them also blocks neighbor discovery, and hosts and router can no longer resolve each other's link-layer addresses. Adding permit icmp any any nd-ns and permit icmp any any nd-na above the explicit deny fixes it; statelessness is tempting, but return traffic leaves through this interface outbound, so an inbound ACL never sees it.

Answer: Under control-plane, with service-policy input

Control plane policing attaches an MQC policy under control-plane configuration mode with service-policy input, so it polices every packet punted to the route processor no matter which interface it arrived on. Interface policies are the tempting choice, but they act on traffic in one direction on one interface and leave other paths to the CPU unprotected, and access-class only limits who may open vty sessions.

Answer: Basic authentication uses Base64, which anyone capturing it can decode

Basic authentication puts the username and password in the Authorization header encoded with Base64, which is reversible encoding, not encryption, so anyone who captures the traffic can read the credentials. REST APIs should run only over HTTPS and preferably use short-lived tokens; the claim that the server will reject plain HTTP is tempting, but many servers accept it, which is exactly the risk.

Answer: Place the sensor inline so it can drop matching packets as an IPS

A sensor fed by SPAN works as an IDS: it sees only copies, so it can raise an alert, but the original packets have already been forwarded. Placing it inline as an IPS, such as Snort in Cisco Secure Firewall, lets it drop malicious packets before they reach the target; better signatures are tempting, but faster detection still does not let an out-of-band sensor block anything.

Answer: Configure MAB as a fallback so ISE authorizes the printers' MACs

MAC Authentication Bypass lets the switch, acting as the 802.1X authenticator, send the endpoint's MAC address to ISE as its identity when no EAP response arrives, so ISE can authorize known printers into the right VLAN or policy. Port security is tempting because it also relies on MAC addresses, but it is a local switch feature with no central policy, and it would take those ports out of the ISE design.

Answer: Identifying applications by behavior and payload, not by port

A next-generation firewall adds application visibility and control, identifying the actual application inside a flow regardless of port so policy can allow or block it, alongside integrated IPS, URL filtering and user identity. Stateful inspection is the tempting answer, but every traditional stateful firewall already does that, and it sees only that the session uses port 443.

Answer: SXP sends IP-to-SGT bindings from the access switches

The SGT Exchange Protocol runs over TCP and lets devices that cannot tag inline send their IP-to-SGT bindings to a peer that can enforce SGACLs or tag the traffic. MACsec is tempting because Cisco can carry the SGT inline on MACsec-protected links, but that still requires inline tagging hardware, which these switches lack.

Answer: MACsec (IEEE 802.1AE)

MACsec encrypts and integrity-protects Ethernet frames between directly connected devices, host to switch or switch to switch, decrypting and re-encrypting at each hop, with keys usually negotiated by MKA. 802.1X with EAP-TLS is the tempting answer because it is often deployed alongside MACsec, but on its own it only authenticates the device and does not encrypt any frames.

Answer: Gi2

data["interfaces"] returns the list of two dictionaries, and Python lists are indexed from zero, so index 1 is the second dictionary and its name key holds Gi2. Gi1 is the tempting answer for anyone counting from one, and a KeyError would occur only if one of the keys did not exist.

Answer: {"name": "Gi1/0/1", "enabled": true, "vlans": [10, 20]}

JSON booleans are lowercase true and false, keys and strings need double quotes, arrays use square brackets, and members are separated by commas. True with a capital T is the tempting choice because Python spells it that way, but it is not valid JSON; parentheses form a Python tuple, and a semicolon is not a valid separator.

Answer: YANG defines a structured schema with typed, validated data

YANG is a data modeling language that defines the structure, data types and constraints of configuration and operational data, so the device returns predictable, machine-readable data encoded in XML or JSON instead of text formatted for people. Calling YANG a transport is the common confusion: NETCONF and RESTCONF carry the data, while YANG describes what that data looks like.

Answer: Send the token in an X-Auth-Token header on each request

Catalyst Center issues a token from the auth endpoint, and each later Intent API request carries it in the X-Auth-Token header until it expires and a new one is requested. Repeating Basic authentication is the tempting shortcut, but the Intent API expects the token, and keeping the password to the token request also limits how often credentials cross the network.

Answer: A GET to /dataservice/device on SD-WAN Manager

SD-WAN Manager exposes its REST API under the /dataservice path, and a GET to /dataservice/device returns the devices in the overlay with details such as system IP, reachability and software version. The /dna/intent path is the tempting look-alike, but it belongs to Catalyst Center, and reading an inventory is a GET, not a POST.

Answer: 409 Conflict

RESTCONF, defined in RFC 8040, treats POST as create-only, so if the target resource already exists the server must refuse the request with 409 Conflict. 201 Created is what a successful POST of a new resource returns; to change an existing loopback the script should use PATCH or PUT, which IOS XE typically answers with 204 No Content.

Answer: Poll the task endpoint with the taskId until the task reports completion

Many Catalyst Center Intent API operations run asynchronously, so 202 Accepted only means the request was received and a task was created; the script must query the task API with that taskId to learn whether the job finished and whether it succeeded. Treating 202 as success is the classic mistake, because the task can still fail after it is accepted, and an expired token would return 401 Unauthorized instead.

Answer: action 0.5 cli command "enable"

EEM runs CLI actions in a vty session that starts in user EXEC mode, so an applet that uses privileged commands such as show running-config must first run cli command "enable". terminal length 0 is tempting because it is common in scripts, but it only stops output paging and does not grant the privilege that show running-config needs.

Answer: Puppet agents pull their catalog from a server; Ansible pushes over SSH

Puppet's standard model is agent-based: each node runs an agent that periodically pulls its catalog from a Puppet server and enforces it, much as Chef does with its client. Ansible is agentless, so a control node pushes tasks from YAML playbooks over SSH or APIs such as NETCONF, which suits devices where nothing extra can be installed.