Sample Cisco CCNP ENCOR 350-401 Practice Questions
Q: Which Cisco architecture provides automated campus network segmentation using identity-based policies?
A: SD-Access — SD-Access uses Cisco Identity Services Engine (ISE) and DNA Center to automate campus network segmentation with identity-based group policies, leveraging VXLAN and LISP in the underlay/overlay.
Q: What does VRF (Virtual Routing and Forwarding) enable on a single physical router?
A: Multiple isolated routing table instances — VRF allows a single physical router to maintain multiple independent routing tables, effectively creating virtual routers. Each VRF instance has its own routing table, enabling traffic isolation between different tenants or segments.
Q: Which OSPF area type blocks all external LSAs (Type 5) from being flooded into it?
A: Stub area — A stub area blocks Type 5 external LSAs from entering the area. The ABR injects a default route instead, reducing the routing table size for routers within the stub area while still providing reachability to external destinations.
Q: Which protocol is used to collect interface counters, CPU usage, and other device statistics via a community string-based polling mechanism?
A: SNMP — SNMP (Simple Network Management Protocol) uses GET/SET operations with community strings (v1/v2c) or username-based authentication (v3) to poll devices for management information stored in the MIB (Management Information Base).
Q: What is the primary function of an Access Control List (ACL) on a Cisco router?
A: Filtering traffic by permitting or denying packets based on defined criteria — ACLs filter network traffic by evaluating packets against ordered rules that permit or deny based on criteria such as source/destination IP, protocol, and port numbers. ACLs are applied to interfaces to control inbound or outbound traffic flow.
Q: Which Python library is commonly used for interacting with network devices via SSH in network automation scripts?
A: Netmiko — Netmiko is a Python library built on top of Paramiko that simplifies SSH connections to network devices from multiple vendors. It provides methods for sending commands, entering configuration mode, and handling device-specific prompts.
Q: In Cisco SD-Access, what is the role of the control plane node?
A: Maintains the host-tracking database using LISP map server/resolver — The control plane node in SD-Access runs LISP as the map server and map resolver (MS/MR), maintaining the Endpoint Identifier (EID) to Routing Locator (RLOC) mapping database for host tracking.
Q: Which overlay encapsulation protocol does Cisco SD-Access use to transport data across the fabric?
A: VXLAN — SD-Access uses VXLAN (Virtual Extensible LAN) as the data plane encapsulation to create the overlay network, allowing Layer 2 and Layer 3 traffic to traverse the fabric underlay.
Q: In an SD-Access fabric, what is the purpose of the Scalable Group Tag (SGT) carried within the VXLAN header?
A: To apply micro-segmentation policy based on group identity without relying on IP addresses — The SGT enables micro-segmentation by tagging traffic with a group identity. Policy enforcement points use SGT-based access control lists (SGACLs) to permit or deny traffic regardless of IP addresses, enabling scalable identity-based security.
Q: Which SD-WAN component is responsible for centralized policy configuration and management?
A: vManage — vManage is the centralized network management system (NMS) for Cisco SD-WAN, providing a GUI dashboard for configuration, monitoring, and policy management across the entire SD-WAN fabric.