Cisco CCNP Enterprise (350-401 ENCOR) — All Questions

In a traditional three-tier enterprise campus design, which layer aggregates access-layer switches and typically enforces routing policy and redundancy between the access and core?

• a.Access layer
• b.Distribution layer✓
• c.Core layer
• d.Data-center spine layer

The distribution layer aggregates access switches, provides Layer 3 boundaries, applies routing and policy, and offers redundancy toward the core. The access layer connects end devices, and the core provides high-speed, low-latency transport between distribution blocks. In a collapsed-core design the distribution and core functions merge.

In a Cisco SD-Access fabric, which plane is responsible for the mapping database that resolves endpoint identifiers to their location (the LISP map system)?

• a.Data plane
• b.Policy plane
• c.Control plane✓
• d.Management plane

In SD-Access, the control plane node runs LISP and maintains the endpoint-to-location mapping database used to resolve where an endpoint is attached. The data plane uses VXLAN encapsulation for forwarding, and policy is carried with scalable group tags. Separating identity from location is the essence of the fabric control plane.

Which wireless deployment model has lightweight access points forward client traffic through a central controller using CAPWAP tunnels?

• a.Centralized (local-mode) deployment with a WLC✓
• b.Autonomous access points with no controller
• c.FlexConnect with all traffic switched locally
• d.Cloud-managed access points with no tunneling

In a centralized local-mode deployment, lightweight APs tunnel client data and control traffic to a wireless LAN controller over CAPWAP, so the controller centralizes forwarding and policy. Autonomous APs work standalone, and FlexConnect can switch some traffic locally at the branch. CAPWAP tunneling to the WLC defines the centralized model.

Which statement correctly distinguishes the control plane from the data plane in a network device?

• a.The data plane builds routing tables and runs protocols like OSPF
• b.The control plane forwards user packets at line rate
• c.Both planes perform identical functions on modern hardware
• d.The control plane builds forwarding information (running protocols), while the data plane forwards packets based on it✓

The control plane runs routing and other protocols and builds the tables that describe how to forward traffic; the data plane (forwarding plane) uses those tables to move user packets, ideally in hardware at line rate. Keeping these functions distinct is central to understanding both traditional and software-defined architectures.

What is the primary difference between a virtual machine and a container?

• a.Containers each include a full guest operating system, while VMs share the host kernel
• b.Each VM runs a full guest OS on a hypervisor, while containers share the host OS kernel and package only the app and its dependencies✓
• c.VMs cannot run network functions, but containers can
• d.Containers require dedicated hardware, while VMs do not

A virtual machine runs a complete guest operating system on top of a hypervisor, whereas a container shares the host's OS kernel and packages just the application and its dependencies, making containers lighter and faster to start. Both can run network functions, and neither requires dedicated hardware per instance.

Which technology lets a single physical link carry traffic for multiple isolated Layer 3 routing domains by associating interfaces with separate routing tables?

• a.HSRP
• b.PortChannel (EtherChannel)
• c.VRF (Virtual Routing and Forwarding)✓
• d.Spanning Tree Protocol

VRF maintains separate, isolated routing tables on the same device, so different VRFs can use overlapping address space and stay logically separate, often extended across links with VRF-lite or MPLS. EtherChannel bundles links for bandwidth, HSRP provides gateway redundancy, and STP prevents Layer 2 loops.

A GRE tunnel is configured between two routers across the internet. What does GRE provide by itself?

• a.Encapsulation of a wide range of protocols in a point-to-point tunnel, without encryption✓
• b.Strong encryption and authentication of all traffic
• c.Automatic dynamic routing without any protocol
• d.Layer 2 switching between distant sites at line rate

Generic Routing Encapsulation creates a point-to-point virtual link that can carry many passenger protocols, but it does not encrypt or authenticate traffic on its own; it is commonly paired with IPsec when confidentiality is required. GRE does not itself provide dynamic routing or Layer 2 switching.

In OSPF, what must match on both routers for a neighbor adjacency to form on a broadcast segment?

• a.Router IDs must be identical
• b.Interface bandwidth values must be identical
• c.Process IDs must be identical
• d.Area ID, subnet/mask, hello and dead timers, and authentication must match✓

For OSPF neighbors to reach full adjacency, the interfaces must share the same area, be on the same subnet, agree on hello and dead intervals, and pass any authentication. Router IDs must be unique, not identical, the process ID is locally significant, and interface bandwidth affects cost but not adjacency formation.

Which attribute does BGP evaluate first (after next-hop reachability) when selecting the best path, and in which direction does a higher value win?

• a.Weight, where the highest weight is preferred (Cisco-proprietary, local to the router)✓
• b.MED, where the highest value is preferred
• c.AS-path length, where the longest path is preferred
• d.Local preference, where the lowest value is preferred

On Cisco routers the first tie-breaker in BGP best-path selection is Weight, which is local to the router and prefers the highest value. Local preference (higher preferred) comes next and is exchanged within the AS, while a shorter AS-path is preferred and a lower MED is preferred later in the process.

Which protocol provides first-hop gateway redundancy and is a Cisco-proprietary option where one router is Active and another is Standby for a shared virtual IP?

• a.VRRP
• b.HSRP✓
• c.GLBP
• d.STP

HSRP (Hot Standby Router Protocol) is Cisco-proprietary and elects an Active router and a Standby router that share a virtual IP and MAC to provide gateway redundancy. VRRP is the open-standard equivalent, and GLBP additionally load-balances across gateways. STP is a Layer 2 loop-prevention protocol, not a gateway redundancy protocol.

On a Layer 2 switch running Rapid PVST+, what is the role of a port that is elected to forward traffic away from the root bridge on a segment?

• a.Root port
• b.Blocking port
• c.Designated port✓
• d.Alternate port

The designated port is the single forwarding port elected for each segment, sending traffic away from the root bridge. The root port is the switch's best path toward the root, an alternate port is a backup to the root port, and a blocking (discarding) port is not forwarding. Each non-root switch has one root port; each segment has one designated port.

Two switches are connected by several links bundled with LACP into one logical link. What benefit does this EtherChannel provide?

• a.Increased aggregate bandwidth and redundancy without spanning-tree blocking the redundant links✓
• b.Automatic routing between VLANs without a Layer 3 device
• c.Encryption of all frames on the bundle
• d.Elimination of the need for a default gateway

An EtherChannel bundles multiple physical links into one logical link, increasing aggregate bandwidth and providing redundancy, and because STP treats the bundle as a single link the member links are not individually blocked. It does not perform inter-VLAN routing, encryption, or remove the need for a gateway.

A switch port should connect to another switch and carry traffic for multiple VLANs. How should the port be configured?

• a.As an access port assigned to one VLAN
• b.As a routed port with an IP address
• c.In administratively shutdown state
• d.As a trunk port using 802.1Q tagging✓

A trunk port uses 802.1Q tagging to carry traffic for multiple VLANs across a single link between switches, preserving VLAN identity with tags (except the native VLAN). An access port belongs to a single VLAN and carries untagged traffic, and a routed port terminates Layer 3, so neither carries multiple VLANs as a trunk does.

Which statement about a VXLAN overlay used in modern campus and data-center fabrics is correct?

• a.VXLAN provides only 4094 total segments, like classic VLANs
• b.VXLAN encapsulates Layer 2 frames in UDP and uses a 24-bit VNID, allowing about 16 million segments✓
• c.VXLAN operates purely at Layer 1 with no encapsulation
• d.VXLAN replaces IP routing entirely in the underlay

VXLAN encapsulates Ethernet frames inside UDP/IP (MAC-in-UDP) and uses a 24-bit VXLAN Network Identifier, providing roughly 16 million segments, far beyond the 4094 of 802.1Q VLANs. It rides on top of a routed IP underlay rather than replacing it, enabling scalable Layer 2 overlays across a Layer 3 network.

Which feature protects a switch against a rogue device sending spoofed DHCP offers by trusting only specified ports for DHCP server responses?

• a.Port security
• b.BPDU guard
• c.DHCP snooping✓
• d.Storm control

DHCP snooping classifies switch ports as trusted or untrusted and permits DHCP server responses only from trusted ports, blocking rogue or spoofed DHCP servers on untrusted ports. It also builds a binding table used by features like Dynamic ARP Inspection. Port security limits MAC addresses, and BPDU guard protects the spanning tree edge.

In an 802.1X port-based authentication deployment, which device plays the role of the authenticator?

• a.The switch or wireless controller that controls port access and relays credentials✓
• b.The RADIUS server that validates credentials
• c.The end-user client (supplicant) requesting access
• d.The DNS server resolving names

In 802.1X, the authenticator is the network access device, typically a switch or WLC, that controls port access and relays authentication messages between the supplicant and the authentication server. The supplicant is the client requesting access, and the authentication server (usually RADIUS) makes the accept or reject decision.

Which pair correctly matches the AAA protocols to a typical use case in a Cisco enterprise?

• a.TACACS+ for network access control of end users; RADIUS for device administration
• b.TACACS+ for device administration with command authorization; RADIUS for network access authentication of endpoints✓
• c.Both TACACS+ and RADIUS can only do accounting, not authentication
• d.RADIUS encrypts the entire packet; TACACS+ encrypts only the password

TACACS+ is commonly used for device administration because it separates authentication, authorization, and accounting and supports per-command authorization, while RADIUS is widely used for network access authentication of endpoints and users. It is TACACS+ that encrypts the full payload, whereas RADIUS traditionally protects mainly the password.

Which management access method should be preferred over Telnet to administer a device securely?

• a.HTTP
• b.SNMPv1
• c.Telnet on a nonstandard port
• d.SSH✓

SSH encrypts the management session, protecting credentials and commands, and should be used instead of Telnet, which sends everything in clear text. Moving Telnet to a nonstandard port does not add encryption, HTTP is likewise unencrypted, and SNMPv1 has weak security; SNMPv3 and SSH are the secure choices.

Which data format is human-readable, uses indentation to denote structure, and is commonly used for Ansible playbooks and network configuration data?

• a.YAML✓
• b.A compiled binary blob
• c.A Cisco IOS running-config only
• d.A packet capture (pcap)

YAML is a human-readable data-serialization format that uses indentation to express structure and is widely used for Ansible playbooks and other configuration data. JSON and XML are also common in automation. A pcap and a compiled binary are not human-editable config formats, and running-config is device-specific CLI, not a portable data format.

Which programmatic interface uses YANG data models and typically runs over SSH to configure and retrieve state from network devices?

• a.SNMPv2c
• b.Syslog
• c.NETCONF✓
• d.ICMP

NETCONF is a network management protocol that uses YANG data models and runs over SSH, exchanging configuration and state as structured XML. RESTCONF offers a similar model over HTTP. SNMP is an older management protocol, syslog carries log messages, and ICMP is for diagnostics, none of which use YANG.

In a REST API, which HTTP method is typically used to retrieve a resource without modifying it?

• a.DELETE
• b.GET✓
• c.POST
• d.PUT

GET retrieves a representation of a resource without changing server state, making it the read operation in REST. POST typically creates a resource, PUT replaces or updates one, and DELETE removes one. Knowing these method semantics is fundamental to consuming controller and device REST APIs such as those on Cisco DNA Center.

What is the main advantage of using an SDN controller such as Cisco DNA Center to manage a network, compared with configuring each device individually via CLI?

• a.It eliminates the need for any underlying network hardware
• b.It makes encryption unnecessary on all links
• c.It removes the requirement for IP addressing
• d.It centralizes policy and configuration, enabling consistent, programmable, and automated management at scale✓

A controller-based SDN model centralizes intent, policy, and configuration and pushes it programmatically to devices through APIs, giving consistent and automated management across many devices rather than error-prone box-by-box CLI. It still relies on real hardware, IP addressing, and appropriate encryption; the gain is centralized, scalable automation.