Free CCNP ENCOR 350-401 Practice Questions with Explanations

Answer: B — vSmart controller.

The vSmart controller (now called the SD-WAN Controller) is the control plane. It builds OMP (Overlay Management Protocol) sessions with every WAN Edge router, receives their routes and pushes back routes, keys and policies.

vBond authenticates devices and helps them find each other (orchestration), vManage is the management plane (GUI, templates, monitoring), and WAN Edge routers form the data plane.

Answer: B — LISP.

The SD-Access control-plane node runs a LISP map server/resolver: it tracks which endpoint (EID) sits behind which fabric edge (RLOC), so traffic can be sent straight to the right switch.

VXLAN is the data plane that carries the traffic, Cisco TrustSec with SGTs is the policy plane, and the underlay usually runs IS-IS (sometimes OSPF), which is not the fabric control plane.

Answer: C — EF (DSCP 46).

Expedited Forwarding is meant for traffic that needs low delay, low jitter and low loss, and is normally placed in the priority (LLQ) queue. Voice bearer is the classic EF traffic.

AF41 is typically used for interactive video, CS3 for call signalling, AF21 for low-latency data such as transactional applications.

Answer: B — It runs directly on the server hardware.

A Type 1 (bare-metal) hypervisor such as VMware ESXi or Microsoft Hyper-V is installed directly on the hardware and controls CPU, memory and I/O itself. That gives better performance and isolation, which is why it is used in data centers.

A Type 2 hypervisor (VMware Workstation, VirtualBox) runs as an application inside a normal operating system. Containers share the host kernel and are a different technology.

Answer: B — Several independent routing tables.

Each VRF has its own routing table and its own interfaces, so 10.0.0.0/24 can exist in VRF BLUE and in VRF RED on the same router without conflict. Traffic does not leak between VRFs unless you configure it.

VRF-Lite is VRFs without MPLS: the separation is kept hop by hop, usually with one VLAN or subinterface per VRF on each link. Encryption and ISP load balancing are unrelated features.

Answer: B — It carries multicast and routing protocols, without encryption.

GRE wraps the original packet in a new IP header plus a 4-byte GRE header (24 bytes in total), so OSPF, EIGRP or multicast can run across a network that would not carry them otherwise.

GRE offers no confidentiality. When encryption is needed, GRE is combined with IPsec (GRE over IPsec), or a VTI is used instead.

Answer: C — Type 3 summary LSA.

An ABR takes the routes it knows from one area and announces them into the other areas as Type 3 summary LSAs. In the routing table they appear as O IA (inter-area).

Type 1 and Type 2 stay inside their area, Type 5 carries external routes redistributed by an ASBR, and Type 4 tells routers in other areas how to reach that ASBR.

Answer: C — Weight.

Weight is a Cisco-specific attribute, local to the router and never advertised to neighbors. Higher wins, and it is checked before everything else.

The usual order after it: highest local preference, locally originated routes, shortest AS path, lowest origin type, lowest MED, eBGP over iBGP, lowest IGP metric to the next hop.

Answer: A — X only.

The feasibility condition: a neighbor’s reported distance must be lower than the successor’s feasible distance. X reports 2500 < 3000, so it is guaranteed loop-free and becomes a feasible successor, ready to be used immediately if the successor fails.

Y offers the shorter backup path (3500 against 4000 via X), but its reported distance 3200 is not lower than 3000, so EIGRP cannot prove it is loop-free. If the successor fails, EIGRP has to query neighbors before it can use Y.

Answer: C — NetFlow.

NetFlow (and Flexible NetFlow) records flows, defined by source and destination address, ports, protocol and interface, and exports the counters to a collector for traffic analysis, capacity planning and security monitoring.

SPAN and RSPAN copy the packets themselves to a monitoring port, local or across a VLAN. IP SLA generates synthetic test traffic to measure delay, jitter and reachability.

Answer: A — IP SLA with object tracking.

An IP SLA icmp-echo probe pings the gateway regularly, a track object follows the probe result, and the static route is bound to it: ip route 0.0.0.0 0.0.0.0 203.0.113.1 track 1. When the pings fail the route is withdrawn, and a backup route can take over.

NetFlow, SNMP traps and syslog report what happens but do not change the routing table.

Answer: B — Severity 0 to 4.

Syslog levels go from 0 (emergencies) to 7 (debugging): 0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications, 6 informational, 7 debugging. Setting a level sends that level and everything more severe, that is, every lower number.

So logging trap 4 (or logging trap warnings) sends levels 0–4.

Answer: B — TACACS+.

TACACS+ runs over TCP 49, encrypts the entire payload and handles authorization separately, so every command an administrator types can be authorized and logged. That fits network device administration.

RADIUS (UDP 1812/1813) encrypts only the password and combines authentication with authorization. It is the usual choice for network access, such as 802.1X and VPN users.

Answer: B — To protect the CPU (control plane).

CoPP applies a QoS policy to the control plane: traffic destined to the router itself (routing protocols, SSH, SNMP, ICMP) is classified and rate-limited, so a flood cannot overload the CPU and bring down routing.

Encryption, voice priority and inter-VLAN filtering are handled by other features (authentication or IPsec, LLQ, ACLs).

Answer: B — Authenticator.

The switch is the authenticator: it blocks the port, relays EAP between the endpoint (EAPoL) and the authentication server (RADIUS), and opens the port when access is granted.

The supplicant is the endpoint’s 802.1X client. The authentication server is the RADIUS server, for example Cisco ISE.

Answer: B — SSH on TCP port 830.

NETCONF runs over SSH with port 830 as its default and exchanges XML-encoded messages (RPCs) built on YANG models.

RESTCONF is the HTTP-based alternative and uses HTTPS, port 443 by default, with JSON or XML.

Answer: B — A data modeling language.

YANG defines the structure of the data, such as containers, lists, leaves and their types, for example what an interface or an OSPF instance looks like. NETCONF and RESTCONF then transport data that follows those models.

The encoding is XML or JSON, and the transport is SSH or HTTPS. Ansible and similar tools are configuration management tools that can use these APIs.

Answer: C — Ansible.

Ansible connects to devices over SSH (or an API) and needs no agent on them, which suits network devices where you cannot install software. Tasks are written in YAML playbooks.

Puppet and Chef use agents that pull configuration from a master server. SaltStack normally uses agents called minions.