ENCOR practice questions
Cisco · 350-401 · 200 questions
Original practice questions for the Cisco ENCOR 350-401 exam, covering enterprise network architecture, virtualization, Layer 2/3 and wireless infrastructure, network assurance, security, and automation for CCNP Enterprise and CCIE Enterprise written-core preparation.
This course contains the use of artificial intelligence.
About the 350-401 exam
- Time allowed
- 2 hours
- Languages
- English, Japanese
Exam details published by the vendor, checked 6 November 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Browse by Domain
Study specific topics at your own pace.
Architecture · 45 questions
- A municipal campus is consolidating wiring closets before a civic-center expansion and must choose a high-level campus design. When is a collapsed-core (2-tier) design a better fit than a classic 3-tier design?
- County elections planners want a fabric-capable underlay so a future SD-Access overlay is not stranded for bandwidth or leaf capacity. Which high-level design consideration should they prioritize first?
- City SaaS tax-portal traffic increasingly exits toward cloud edges rather than staying on campus. Which high-level design trade-off should architects emphasize when comparing on-campus aggregation to a cloud-connected pattern?
- Library branches want first-hop gateway redundancy so clients keep a default gateway during an uplink failure without waiting for Layer 2 STP reconvergence alone. Which approach addresses that need?
- Police HQ dual-supervisor chassis must keep forwarding during control-plane failover. Which high-availability feature is intended to provide stateful switchover of the control plane rather than a cold reboot of the newly active supervisor?
- Transit operations links dual distribution switches and debates HA techniques before a cutover. Which statement correctly contrasts device redundancy with path redundancy?
- Parks HQ outgrew a single collapsed core and is adding a dedicated core layer for east-west civic applications. Why introduce a separate core tier in that situation?
- Wastewater SCADA gateways need dual uplinks and dual gateways before monsoon season. Which HA combination best matches that edge requirement?
- A school district wants centralized wireless LAN controller management across fifty campuses with consistent policy. Which wireless deployment model characteristic best matches that goal?
- Remote ferry terminals lack local IT staff, and the county wants easy install plus cloud visibility for wireless. Which deployment model best fits?
- A convention center is comparing controller-based wireless to a controller-less design for one large venue. What is a primary trade-off they should weigh?
- County clerk branch offices must keep local wireless client forwarding if the WAN path to the HQ WLC drops. Which wireless design approach addresses that risk?
- A museum wayfinding app requires the WLAN design to support location services for visitor devices. Which design consideration is most relevant?
- Stadium bowl Wi-Fi fails post-event surveys after ticket-holder density spikes. At a design-principle level, what must planners prioritize?
- Animal services wants a remote-branch wireless model with a lightweight local AP footprint and centralized oversight. Which statement best identifies that model’s intent?
- City hall atrium mixes guests and staff and needs centralized policy with optional local data-path flexibility. How should designers match the wireless deployment model?
- County WAN refresh compares traditional hub-and-spoke MPLS to Cisco SD-WAN overlays for branch clinics. Which benefit is most characteristic of SD-WAN at ENCOR principle depth?
- Emergency management asks which plane in Cisco SD-WAN is primarily responsible for building control relationships among controllers and WAN edges at principle depth?
- Sanitation branch routers must encrypt and forward overlay traffic, but staff confuse planes. Which statement correctly identifies the SD-WAN data plane role?
- A port authority wants transport independence across LTE and broadband underlays using SD-WAN principles. What does that benefit mean?
- City finance flags operational complexity before purchasing SD-WAN controllers. Which limitation should architects acknowledge at principle depth?
- Housing authority engineers map vManage-class orchestration into the Cisco SD-WAN plane story at ENCOR depth. Where does that orchestration/management function fit?
- A 911 PSAP needs predictable underlay transport plus overlay encryption. How should architects separate responsibilities in Cisco SD-WAN principles?
- A courthouse campus evaluates SD-Access fabric and asks what the fabric control plane primarily contributes versus classic VLAN sprawl?
- A community college asks what carries user traffic in the SD-Access fabric data plane at principle depth?
- City hall is phasing Cisco SD-Access into one building while the rest of the campus stays on a traditional distribution block. What migration approach best matches ENCOR SD-Access principles?
- Police evidence VLANs are moving into an SD-Access fabric while several non-fabric floors must still reach those resources. Which fabric role is primarily responsible for that handoff at ENCOR principle depth?
- Library RFID scanners need segmentation inside an SD-Access fabric without first redesigning every classic access VLAN. What fabric capability primarily enables that outcome?
- A municipal hospital is comparing SD-Access fabric edge onboarding with assigning clinician devices to static access VLANs. What is the key contrast at ENCOR principle depth?
- Airport operations wants SD-Access in new terminals but must keep legacy printers reachable on a non-fabric floor. Which statement best reflects traditional campus interoperability?
- Voter registration offices ask which SD-Access plane tracks endpoint identity and location mappings across the fabric?
- Dispatch radio-over-IP and civic VoIP share congested uplinks. When interpreting the campus QoS policy, which statement correctly separates common QoS components?
- A school district voice SSID must keep the same treatment as wired classroom phones across the campus path. What should architects verify when interpreting end-to-end QoS?
- Courts streaming evidence video is being dropped hard at the WAN edge during bursts. Interpreting the QoS policy, which behavior indicates policing rather than shaping?
- Transit operations marks PSAP-bound traffic at trusted phones, then asks where the campus QoS trust boundary should typically be enforced?
- City guest Wi-Fi bulk transfers share an uplink with ticket-window VoIP. Interpreting a CBWFQ-style policy, what outcome should staff expect under congestion?
- Parks drone uplinks compete with staff laptops on a congested distribution link. Which QoS component is responsible for scheduling packets from queues after traffic has already been classified and marked?
- A municipal hospital needs clinician softphones on WLAN to receive the same expedited forwarding treatment that wired campus phones already get. What should the QoS interpretation confirm?
- After a supervisor upgrade, the city core must forward civic application traffic with Cisco Express Forwarding rather than process switching. What is the key characteristic of CEF in that role?
- An access switch in the civic center is filling its MAC address table, and staff worry they are also exhausting ACL capacity. How do CAM and TCAM roles differ?
- After a static route change on an edge router, the civic NOC sees confusion between the routing table and what is actually used to forward packets. Which table should they inspect for the CEF forwarding decision?
- Distribution TCAM exhaustion is preventing new ACL entries from installing for court VLANs. What does that symptom indicate about TCAM's role?
- At the water plant, CEF shows incomplete adjacency information after an ARP failure and traffic to that next hop is blackholed. What role does the adjacency table play?
- A campus engineer explains the hardware switching path on the city core. Which components correctly describe optimized CEF forwarding versus a software punt?
- A library stack switch ages out CAM entries and unknown unicasts begin flooding, which staff mistakenly blame on the Layer 3 FIB. What distinction should they apply?
Virtualization · 30 questions
- The city virtualization cluster runs a bare-metal hypervisor under production VMs. How does that Type 1 model differ from a Type 2 hypervisor?
- County clerk staff want a quick lab of VDI images on admin workstations using a hosted hypervisor. Which choice best fits that Type 2 use case versus production Type 1?
- Transit OCC must keep fare-collection VMs isolated from CAD VMs even though both run on the same hypervisor host. What is the primary purpose of that VM isolation?
- A police evidence VM needs connectivity to the evidence network through the host. Which component provides that Layer 2 switching function for the VM's vNIC?
- Sanitation's datacenter lab is comparing a hypervisor-hosted virtual router with a physical CPE appliance. What trade-off best reflects device virtualization at ENCOR depth?
- After vandalism, the library kiosk farm must rebuild guest images quickly from a known-good baseline. What device-virtualization benefit best explains that approach?
- Airport operations is sizing a new production hypervisor cluster and needs to know whether the hypervisor should sit on bare metal or atop a general-purpose host OS. Which statement correctly distinguishes the models?
- Courthouse lab engineers want virtual-switch VLANs that mirror production segmentation for case-management and public-Wi-Fi guests. What should they expect from virtual switching?
- A water utility must keep SCADA routing separate from guest Wi-Fi on the same edge router. Which data-path virtualization approach best meets that need?
- Parks HQ needs an IP overlay to a remote nature center across an untrusted ISP and staff propose a plain GRE tunnel. What limitation should they recognize?
- Police records must traverse a GRE path to a records annex, and confidentiality is required. Why combine IPsec with GRE rather than leaving GRE alone?
- City hall discovers finance routes appearing inside the public-kiosk VRF after a change. What does that symptom most clearly indicate about VRF design?
- Ferry terminal staff are building a simple point-to-point GRE overlay and must set tunnel endpoints correctly. What roles do the tunnel source and destination play?
- A housing authority needs site-to-site confidentiality for ordinary IP unicast between two offices and does not require GRE's multiprotocol overlay. Which approach fits?
- A municipal hospital must multi-tenant guest Wi-Fi routing away from clinical systems on shared edge routers. What is the primary VRF benefit in that design?
- A 911 PSAP backup path uses GRE across LTE, and operators need to confirm the overlay is usable. Which verification concept best matches ENCOR data-path virtualization?
- County jail needs a shared printer reachable from two VRFs and plans a carefully controlled inter-VRF route exchange. How does that differ from an accidental leak?
- The convention center DMZ must protect partner connectivity across the Internet at ENCOR depth. What is the primary purpose of IPsec tunneling in that scenario?
- A school district overlays student-info traffic with GRE and then protects that path with IPsec. How should staff describe each technology's role?
- Public works places IoT meter prefixes in a VRF that must not reach finance subnets by default. Which VRF property supports that outcome?
- An airport team exploring fabric concepts asks what problem LISP addresses with locator/ID separation. Which statement is most accurate at ENCOR depth?
- City fabric architects name the data-plane encapsulation used to carry overlay segments across an IP underlay. Which technology fills that role in common enterprise fabric designs discussed in ENCOR?
- County IT is constrained by classic VLAN's 12-bit identifier space and evaluates VXLAN for larger segmentation scale. What advantage should they cite?
- Fabric-edge discussion at the county describes map-and-encap so endpoints keep stable identities while locators change. Which LISP idea does that describe?
- Stadium multi-tenant networks are drowning in sprawling Layer 2 VLANs and evaluate VXLAN VNIs for segmentation. What contrast matters most?
- Library architects ask whether LISP is primarily a control-plane mapping system in fabric-style designs rather than the data-plane encapsulation itself. Which answer is best?
- Police HQ wants overlays that span sites across a Layer 3 underlay without stretching pure Layer 2 domains. Which network-virtualization approach matches that goal?
- A municipal datacenter lab contrasts LISP terms with classic IP routing alone. How do EID and RLOC differ conceptually?
- Port authority engineers discuss which devices encapsulate and decapsulate VXLAN traffic. What is the VTEP's role?
- Emergency management is designing a fabric-style solution and asks how LISP and VXLAN typically complement each other at ENCOR concept depth?
Infrastructure · 90 questions
- A city IT team wants the access-to-distribution link to carry multiple civic VLANs as an 802.1Q trunk, but staff keep seeing unexpected dynamic trunk negotiation after switch replacements. Which approach best removes that surprise while keeping a stable trunk?
- Courts distribution and access switches share an 802.1Q trunk, but untagged CDP and control traffic behave oddly after a closet rebuild. Engineers discover the native VLAN numbers differ on each end of the trunk. What is the most accurate description of that problem?
- Library stacks try to bundle two uplinks into an EtherChannel: one switch is set to LACP active and the peer ports are set to static ON mode. The Port-Channel never comes up as expected. What is the primary reason?
- Transit distribution builds a Port-Channel toward the fare-collection system, yet a single large TCP flow still saturates one member link. What limitation of EtherChannel load balancing best explains this?
- A school district wants edge access ports to err-disable if someone plugs in a rogue switch that starts sending BPDUs. Which feature best matches that requirement?
- Parks and Recreation places the STP root on distribution and wants designated ports toward wiring closets to refuse a superior BPDU from a downstream switch trying to become root. Which feature addresses that goal?
- City Hall migrates closets from classic 802.1D STP to Rapid-PVST+ after long reconvergence during switch failures. What is the main operational benefit they should expect?
- A convention center campus carries dozens of VLANs and wants fewer STP instances than per-VLAN Rapid-PVST+. Which technology best matches that goal?
- A police department closet accidentally trunks a user-facing port after a cable move, and investigators blame dynamic trunk negotiation. What is the best hardening practice for those user ports?
- At a water treatment plant, one physical member of an EtherChannel fails while the remaining members stay up. What should operators expect for traffic that still hashes to healthy members?
- A municipal hospital suddenly sees an access uplink move to a blocking role after a new switch is introduced in a closet ring. What STP concept best explains why a previously forwarding path may block?
- Airport operations notices the luggage-handling VLAN no longer passes on a trunk after a maintenance window. CDP neighbors still appear. Which trunk check is the most likely next step?
- A housing authority wants deterministic LACP negotiation on distribution uplinks so the channel forms even if the peer is passive. Which LACP role pairing best meets that intent?
- A 911 PSAP wants host-facing ports to come up quickly for workstations yet still shut down if a BPDU appears. Which combination best expresses that intent?
- A city museum ring of switches runs RSTP with one elected root. A non-root switch has a port that provides a backup path toward the root but does not forward. Which RSTP port role is that?
- Sanitation yard technicians cross-connect two closet switches with two ordinary access links and forget to build an EtherChannel. What prevents a Layer-2 loop from melting the yard network?
- County clerk switches are intended to share one MST region, but VLAN-to-instance mapping looks inconsistent after a partial config push. Which requirement is essential for switches to remain in the same MST region?
- After a fire-station access switch replacement, an uplink unexpectedly becomes a trunk via DTP even though the design called for a static access handoff to a phone closet device. What is the best corrective action?
- A municipal stadium aggregates two 10-Gbps distribution uplinks from an access switch into one logical Port-Channel. What primary benefit does that EtherChannel pattern provide?
- At a voter registration office, Root Guard is enabled on a distribution port toward an access switch. The access switch suddenly advertises a superior bridge ID. What is Root Guard’s expected local reaction?
- Public works engineers finish an MST deployment and must confirm voice and data VLANs follow the intended MST instances. What should they verify first?
- City fleet garage trunks flap with CDP and spanning-tree oddities after one side tags the native VLAN and the other still expects classic untagged native behavior. Which troubleshooting family does this fall into?
- County WAN engineers compare EIGRP’s composite metric and DUAL behavior with OSPF’s cost-based SPF on civic WAN routers. Which comparison is most accurate at ENCOR depth?
- City Hall wants unequal-cost multipath awareness historically associated with EIGRP, not only equal-cost paths. How does that differ from classic OSPF behavior?
- Transit OCC routers on a shared Ethernet segment fail to form a stable OSPF adjacency after one side is set to point-to-point and the other remains broadcast. What is the most likely impact of that network-type mismatch?
- A school district runs multi-area OSPF and wants campus prefixes summarized toward the WAN so area routers carry fewer Type-3 LSAs. Where should the engineer place that summarization?
- Police HQ must keep a jail VLAN's prefixes from being advertised campus-wide through OSPF while still routing inside the jail area. Which approach matches that inter-area filtering goal?
- A city library wants OSPF to advertise user VLAN subnets from SVIs without sending hellos or forming adjacencies on those access-facing interfaces. Which feature meets that requirement?
- An airport edge router forms eBGP with an ISP on a directly connected interface. Which neighbor relationship expectation is correct for that ENCOR-scoped design?
- A port authority sees two ISP paths in eBGP and needs to understand how the router chooses a single best path at ENCOR depth. Which statement is accurate?
- A water utility must steer traffic matching an extended ACL toward a scrubbing path instead of following destination-based routing alone. Which feature describes that capability?
- Courts IT is building multi-area OSPF with several normal areas for civic buildings. Which backbone rule must the design obey?
- Housing authority engineers compare how EIGRP and OSPF compute loop-free paths after a topology change. Which contrast is correct at ENCOR depth?
- A municipal hospital closet is dual-stack and must run OSPF for both IPv4 and IPv6. Which pairing correctly describes the protocol roles?
- City WAN staff configure eBGP multihop toward an ISP even though the neighbor is on the same directly connected subnet. What is the correct ENCOR expectation for that adjacency?
- Parks HQ wants guest-subnet traffic forced through a firewall path while staff traffic continues to follow normal destination routing. Which tool fits that selective steering use-case?
- A 911 PSAP reports an OSPF adjacency that never reaches FULL between two routers on a shared Ethernet segment. Timers show mismatched hello and dead intervals. What should the engineer conclude?
- Sanitation networking staff hear EIGRP terms reported distance and feasible distance and ask how that vocabulary differs from OSPF. Which statement is correct?
- A stadium ABR summarizes campus prefixes toward other OSPF areas. After a link failure inside the summarized range, remote routers no longer see more-specific prefixes. What trade-off should engineers expect?
- A ferry terminal runs stable single-area OSPF today and is adding a second campus that should not share a full identical LSDB with the terminal. When is introducing another normal area appropriate?
- A community college edge uses eBGP to two providers and wants outbound traffic to prefer one ISP using a well-known BGP best-path attribute. Which attribute awareness matches ENCOR depth for that goal?
- Animal services connects several OSPF routers on a broadcast Ethernet segment and sees a designated router and backup designated router elected. What is the purpose of that election?
- City planning needs a temporary construction-trailer subnet steered to a specific inspection firewall without redesigning the entire destination-based routing policy. Which description of PBR fits?
- County jail engineers must stop evidence-VLAN prefixes from leaking through OSPF toward a guest edge while keeping other jail routes. Which action aligns with simple OSPF prefix filtering?
- Fire/EMS dual-homes to two ISPs with eBGP for civic Internet. Within ENCOR scope, which neighbor pattern is the expected model?
- Museum campus engineers compare how EIGRP and OSPF react when a successor path disappears. Which operational contrast is accurate?
- A public library Ethernet WAN-style link between two routers should avoid DR/BDR election while still running OSPF. Which network-type choice fits that goal?
- Voter registration SVIs are configured as OSPF passive interfaces. What behavior should the team expect?
- City fleet garage applies PBR with a route-map. Traffic that does not match a permit clause falls through. How is that unmatched traffic forwarded?
- A wastewater plant should sit in its own OSPF normal area while remaining part of the city's multi-area design. Which attachment pattern is correct?
- A city stadium survey finds clients near the scoreboard report low SNR despite moderate RSSI. Which RF interpretation should the wireless engineer apply?
- A county library basement shows weak client RSSI. Staff propose raising AP transmit power and adding APs. Which RF concept pairing is most relevant?
- An airport remote concourse needs locally switched user traffic if the WAN to the central WLC is impaired. Which AP mode best matches that requirement?
- A courthouse needs focused coverage down a long corridor without spraying RF into adjacent courtrooms. Which antenna choice fits best?
- A school district AP fails to join its WLC. Engineers review CAPWAP discovery paths including DHCP and DNS. Which statement best describes the join principle?
- Police body-worn camera carts roam across floors that remain in the same VLAN versus carts that move onto a different subnet in another building. Which roaming distinction matters?
- City hall reports a WLAN client that will not authenticate. Per ENCOR emphasis, which troubleshooting approach should staff prioritize first on the WLC?
- A convention center must keep exhibit-floor guest WLANs policy-separated from staff WLANs on the same AP hardware. Which wireless construct set addresses that segmentation?
- Ferry terminal Wi-Fi suffers intermittent interference resembling strong non-Wi-Fi noise on a crowded band. Which RF planning response is most appropriate?
- A hospital AP is configured with primary and secondary WLC entries. After the primary fails, which join behavior should operations expect?
- Parks and recreation needs outdoor coverage focused toward a picnic pavilion rather than broadcasting equally in all directions. Which antenna approach fits?
- A community college WLAN mixes legacy clients with modern Wi-Fi 6 devices in the same BSS. Which planning concern is most accurate?
- A 911 PSAP needs seamless wireless mobility for devices that move between buildings on different IP subnets. Which roaming requirement applies?
- A museum runs guest and staff SSIDs on the same APs but needs different WLAN policies. Which approach aligns with ENCOR wireless segmentation?
- A sanitation yard AP remains stuck in discovery and never joins. The DHCP scope lacks the option that provides WLC addressing. Which discovery insight is correct?
- City council chambers need high client-count WLAN service from APs that still terminate CAPWAP to a WLC. Which mode concept is appropriate?
- A housing authority client associates to the WLAN but fails to obtain a DHCP address afterward. Using WLC GUI-oriented troubleshooting, what should engineers examine?
- A port authority wants wireless roam domains designed so devices stay on the same subnet across a contiguous terminal whenever possible. Which principle applies?
- An animal shelter Wi-Fi survey records RSSI and noise floor readings at a kennel doorway. How should engineers relate these to SNR?
- A voter registration center maps APs into the correct policy set for that building. Which wireless construct primarily binds APs to a site’s policy set in modern controller architectures?
- A fire training tower needs APs that actually serve firefighter tablet clients, not merely scan the air. Which AP mode concept is correct?
- City Wi-Fi GUI shows a client marked excluded after repeated auth failures. How should engineers interpret that during connectivity troubleshooting?
- Court IT must interpret device NTP lines so syslog timestamps align after an incident. A router shows it is synchronized to an upstream NTP server. Which interpretation is correct?
- A transit operations center evaluates timing for signaling gear that needs sub-microsecond synchronization. Which IP services comparison is appropriate?
- City staff on RFC1918 interiors browse the Internet through one public address. Which NAT behavior provides that many-to-one translation?
- A city library needs to publish an internal catalog server so remote patrons reach it on a fixed public address. Which NAT approach best matches that inbound publish requirement?
- Police access VLANs need a resilient default gateway so desktop cameras keep forwarding if one distribution switch fails. What is HSRP’s primary purpose in that design?
- A water utility edge mixes Cisco and another vendor’s routers and must keep a standards-based first-hop redundancy protocol. Which choice best fits that multi-vendor constraint?
- Stadium multicast video uses PIM and IGMP, but one camera stream is dropped when RPF checks fail on a distribution router. What does a successful RPF check verify before forwarding that multicast?
- School IPTV receivers must signal which multicast groups (and, when needed, which sources) they want while the LAN uses IGMP snooping with PIM upstream. Which statement best describes IGMPv2/v3’s role?
- A municipal hospital wants multicast clinical imaging to follow PIM sparse-mode concepts at ENCOR describe depth. What is PIM-SM’s core role in that design?
- A 911 PSAP must keep trusted time so incident logs stay aligned. When interpreting NTP choices at ENCOR depth, which practice best supports a secure, reliable time source?
- Passenger Wi-Fi at the airport suddenly cannot open new sessions while existing long-lived flows still pass. Engineers suspect the PAT pool is exhausted. Which symptom best matches that NAT condition?
- After a parks distribution switch reboots, staff want the higher-priority HSRP router to reclaim active forwarding without waiting for the current active to fail. Which concept enables that behavior?
- County jail endpoints should use one stable default-gateway address while two routers provide VRRP redundancy. Which address should those endpoints configure as their gateway?
- City hall applies a multicast boundary that unexpectedly stops needed PIM traffic toward a civic venue. What is the most accurate impact of that boundary?
- Convention-center engineers interpret NTP status and see a stratum value on a boundary clock. What does that stratum number primarily indicate?
- Sanitation publishes a SCADA historian reverse proxy with a permanent public mapping. Which NAT type best matches that one-to-one inbound publish use-case?
- A community-college switch floods IPTV to every port until IGMP snooping is enabled. What problem does IGMP snooping primarily solve?
- Emergency management needs separate resilient gateways for data and voice VLANs on the same distribution pair. Which HSRP approach best fits?
Network Assurance · 30 questions
- The city NOC must troubleshoot courts connectivity without flooding the console with debugs from every subnet. Why choose a conditional debug?
- Transit fare-server traffic stalls somewhere along the path. Which diagnostic best shows where packets stop hop-by-hop toward that server?
- Library patrons can ping a catalog server, but the application still fails. Which next diagnostic direction is most appropriate among common ENCOR assurance tools?
- During an outage review, police engineers find no local record of a critical link-down. Which assurance practice would best have preserved that event for later diagnosis?
- Airport operations notice interface errors only after a complaint, because polling gaps hid the trend. What role does SNMP play in that diagnosis story?
- A water-plant engineer enables a targeted debug to catch a flapping adjacency, then finishes the capture. What safe-practice step is essential in production?
- On game day the stadium NOC needs top talkers and conversation visibility across uplinks. Which technology best supplies that Flexible NetFlow-style traffic visibility?
- Courts networking wants customizable 5-tuple visibility rather than a legacy fixed NetFlow record format. What distinguishes Flexible NetFlow for that goal?
- City hall enabled Flexible NetFlow, but the collector shows no new flows. Which verification focus is most relevant?
- A school district wants proof that guest Wi-Fi conversations are not reaching finance subnets. How does Flexible NetFlow help validate that policy intent?
- A port authority enables Flexible NetFlow on edge routers and wants to confirm the exporter and cache are actually working before trusting the dashboards. Which verification approach best matches that goal?
- Police HQ needs a packet analyzer to see traffic from one switch access port that serves an evidence-intake workstation, and both the source port and the analyzer attach to the same switch. Which capture method fits that requirement?
- A county wants to mirror traffic from closet access switches to a central analyzer in the data center closet, keeping the mirrored frames inside a Layer-2 campus fabric. Which SPAN-family approach is designed for that remote Layer-2 capture?
- An airport places its packet analyzer on a different IP subnet across the routed core and needs mirrored frames delivered to that analyzer. Which technology is intended for that Layer-3 path?
- A library SPAN session mirrors a busy uplink onto a 1-Gbps analyzer port and staff notice drops and incomplete captures during peaks. What operational constraint best explains that behavior?
- A 911 PSAP analyzer sits beyond a Layer-3 core, and operators reject creating an RSPAN VLAN end-to-end across that routed boundary. Which choice correctly justifies ERSPAN instead?
- A city NOC wants ongoing reachability checks from core routers to clinic edge routers over the municipal WAN without relying only on manual pings. Which IP SLA operation best matches that connectivity-monitoring goal?
- Transit voice engineers need an IP SLA test that estimates delay variation along the path used for radio-dispatch VoIP, not only basic ICMP reachability. Which operation type targets that quality metric?
- Courts want a tracked object so that when an IP SLA reachability probe to the primary WAN next hop fails, HSRP or static routing can react and shift traffic. What role does that tracking relationship provide?
- A hospital campus runs UDP jitter IP SLA tests from a core router toward clinic gateways. For accurate two-way measurements that need a far-end participant, which role relationship is required?
- Parks and Recreation runs IP SLA probes over a small LTE backup link and sets an extremely aggressive frequency. Staff then see the backup link congested by the probes themselves. What is the sound operational takeaway?
- A city wants Cisco DNA Center (Catalyst Center family) to push consistent access-switch port templates to closet devices instead of hand-editing each switch. Which workflow family addresses that goal?
- County courts Wi-Fi users report intermittent issues, and operators open Cisco DNA Center assurance views to inspect client health and related network symptoms. Which workflow purpose does that illustrate?
- Airport network staff use Cisco DNA Center to maintain device inventory and manage software images across campus switches. Which workflow category best describes those tasks?
- A library team sees marketing materials that rename Cisco DNA Center to Catalyst Center and worries their ENCOR workflow skills no longer apply. What is the accurate continuity takeaway for assurance workflows?
- A school district uses controller workflows both to apply campus access policy consistently and to investigate client path problems with assurance tools such as path-oriented visibility. What does that combined use demonstrate?
- City automation engineers want a model-driven way to set interface descriptions on IOS XE edge routers using YANG-based RPC operations over a secure management channel. Which protocol is the primary fit?
- Courts developers prefer creating VLANs on campus switches through an HTTP-style API that uses YANG data models rather than NETCONF XML RPCs. Which interface matches that preference?
- Transit architects compare management transports for model-driven automation on IOS XE. Which contrast correctly distinguishes NETCONF from RESTCONF at a conceptual level?
- A water utility validates that RESTCONF is working by retrieving a modeled interface resource and inspecting the returned data encoding. Which outcome best confirms successful RESTCONF resource retrieval?
Security · 5 questions
- A city hardens router management access so remote administrators must use SSH on the VTY lines, with authentication against locally configured usernames if the AAA servers are unreachable. Which approach best matches that intent?
- Court switch audits find the console line still permits unauthenticated access, so anyone with physical access can enter privileged configuration. What change correctly addresses that finding?
- Airport network admins must authenticate to network devices using a central TACACS+ server, yet still log in during WAN outages that isolate the AAA servers. Which AAA authentication pattern fits?
- Police command wants TACACS+ to control which administrators may enter configuration mode commands that change ACLs, rather than only verifying passwords at login. Which AAA function provides that command control?
- A library creates local usernames so helpdesk staff can run show commands while only network admins receive higher privilege for configuration. What concept does that local-user design illustrate?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.