Sample Cisco CCNP ENCOR 350-401 Practice Questions
Q: Which Cisco architecture provides automated campus network segmentation using identity-based policies?
A: SD-Access. SD-Access uses Cisco Identity Services Engine (ISE) and DNA Center to automate campus network segmentation with identity-based group policies, leveraging VXLAN and LISP in the underlay/overlay.
Q: What does VRF (Virtual Routing and Forwarding) enable on a single physical router?
A: Multiple isolated routing table instances. VRF allows a single physical router to maintain multiple independent routing tables, effectively creating virtual routers. Each VRF instance has its own routing table, enabling traffic isolation between different tenants or segments.
Q: Which OSPF area type blocks all external LSAs (Type 5) from being flooded into it?
A: Stub area. A stub area blocks Type 5 external LSAs from entering the area. The ABR injects a default route instead, reducing the routing table size for routers within the stub area while still providing reachability to external destinations.
Q: Which protocol is used to collect interface counters, CPU usage, and other device statistics via a community string-based polling mechanism?
A: SNMP. SNMP (Simple Network Management Protocol) uses GET/SET operations with community strings (v1/v2c) or username-based authentication (v3) to poll devices for management information stored in the MIB (Management Information Base).
Q: What is the primary function of an Access Control List (ACL) on a Cisco router?
A: Filtering traffic by permitting or denying packets based on defined criteria. ACLs filter network traffic by evaluating packets against ordered rules that permit or deny based on criteria such as source/destination IP, protocol, and port numbers. ACLs are applied to interfaces to control inbound or outbound traffic flow.
Q: Which Python library is commonly used for interacting with network devices via SSH in network automation scripts?
A: Netmiko. Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices from multiple vendors. It provides methods for sending commands, entering configuration mode, and handling device-specific prompts.
Q: In Cisco SD-Access, what is the role of the control plane node?
A: Maintains the host-tracking database using LISP map server/resolver. The control plane node in SD-Access runs LISP as the map server and map resolver (MS/MR), maintaining the Endpoint Identifier (EID) to Routing Locator (RLOC) mapping database for host tracking.
Q: Which overlay encapsulation protocol does Cisco SD-Access use to transport data across the fabric?
A: VXLAN. SD-Access uses VXLAN (Virtual Extensible LAN) as the data plane encapsulation to create the overlay network, allowing Layer 2 and Layer 3 traffic to traverse the fabric underlay.
Q: In an SD-Access fabric, what is the purpose of the Scalable Group Tag (SGT) carried within the VXLAN header?
A: To apply micro-segmentation policy based on group identity without relying on IP addresses. The SGT enables micro-segmentation by tagging traffic with a group identity. Policy enforcement points use SGT-based access control lists (SGACLs) to permit or deny traffic regardless of IP addresses, enabling scalable identity-based security.
Q: Which SD-WAN component is responsible for centralized policy configuration and management?
A: vManage. vManage is the centralized network management system (NMS) for Cisco SD-WAN, providing a GUI dashboard for configuration, monitoring, and policy management across the entire SD-WAN fabric.