Text preview & study summary

Cisco CCNP Enterprise ENCOR 350-401 - All Domains Architecture Virtualization Infrastructure Security Automation

A free sample of 5 questions from this quiz, shown in full with answer choices and explanations. No interactivity — everything is visible on this page for study and review.

Want to test your knowledge? Launch the Interactive Exam Simulator

Question 1

A network engineer uses Cisco DNA Center to push configuration changes to 200 switches simultaneously. After the push, three switches report failures. Which DNA Center feature allows the engineer to quickly identify root cause across all devices?

Answer choices

  • A. Network Intent

  • B. Path Trace

  • C. Assurance with AI/ML analytics (Correct)

  • D. Template Editor

Explanation

Cisco DNA Center Assurance uses AI/ML analytics to correlate telemetry across the entire network, identify anomalies, and provide root cause analysis. Path Trace is used for per-flow connectivity analysis. Network Intent is used to define desired state. Template Editor is used to build configuration templates. Assurance is the primary tool for health monitoring and root cause identification at scale.

Question 2

An engineer is troubleshooting an EIGRP issue. A route to 10.50.0.0/16 is in the topology table as a feasible successor but not installed in the routing table. What does this indicate?

Answer choices

  • A. The route has failed the feasibility condition

  • B. The route is a backup path that meets the feasibility condition (Correct)

  • C. The route's reported distance is greater than the successor's feasible distance

  • D. EIGRP has been disabled for that network

Explanation

In EIGRP, a feasible successor is an alternate path that satisfies the Feasibility Condition (FC): the neighbor's Reported Distance must be less than the local router's Feasible Distance to the destination. A feasible successor is stored in the topology table as a ready backup but is not placed in the routing table unless the successor fails. This enables sub-second failover without requiring a new route calculation (DUAL algorithm). Option C describes a route that FAILS the FC and therefore cannot be a feasible successor.

Question 3

A Cisco SD-WAN deployment uses application-aware routing policies. The policy should route voice traffic over the MPLS link if the latency is below 150ms and jitter is below 30ms; otherwise, it should use the broadband link. Which SD-WAN feature enables this?

Answer choices

  • A. Data policies with Application-Aware Routing (AAR) (Correct)

  • B. Control policies with service chaining

  • C. QoS policies with DSCP remarking

  • D. Security policies with URL filtering

Explanation

Cisco SD-WAN Application-Aware Routing (AAR) uses SLA metrics (latency, jitter, packet loss) measured by BFD probes to dynamically select the best transport path for specific application traffic. AAR policies define SLA thresholds and specify which transport to use when thresholds are met or breached. Control policies affect route distribution in the overlay. QoS handles traffic classification and queuing. Security policies handle threat inspection.

Question 4

An engineer is implementing 802.1X port-based authentication with MAB as a fallback for devices that don't support 802.1X. Which statement describes MAB (MAC Authentication Bypass)?

Answer choices

  • A. MAB authenticates the device using its IP address as the identity

  • B. MAB sends the device's MAC address as both the username and password to a RADIUS server (Correct)

  • C. MAB uses a pre-shared key stored on the switch for device authentication

  • D. MAB requires an EAP conversation between the endpoint and the switch

Explanation

MAC Authentication Bypass (MAB) is used for devices incapable of 802.1X. When the switch detects no 802.1X response after timeout, it sends the device's MAC address as both the username and password in a RADIUS Access-Request. The RADIUS server checks the MAC address against its database and grants or denies access. No EAP exchange is required. No pre-shared key is used on the switch for MAB. IP addresses are not used for MAB identity.

Question 5

An enterprise network runs IS-IS as the IGP. A network engineer notices that routes from Level 1 routers are not appearing in the Level 2 domain. What is the most likely cause?

Answer choices

  • A. IS-IS redistribution between levels is not configured

  • B. Level 1 routes are automatically leaked into Level 2 by default only by L1/L2 routers (Correct)

  • C. The area address on Level 1 routers does not match the Level 2 backbone area

  • D. IS-IS does not support hierarchical routing between levels

Explanation

In IS-IS, Level 1/Level 2 (L1/L2) routers automatically leak Level 1 route summaries into the Level 2 backbone — but only as summaries, not specific routes, unless route leaking or redistribution is explicitly configured. If L1 routes are not appearing in L2, the L1/L2 router may be filtering them or not properly configured. Level 2-only routers do not have access to L1 topology. IS-IS uses area addresses for L1 but L2 routing spans all areas. No explicit redistribution command is needed, but route leaking must be enabled for specific prefixes to propagate from L1 into L2.