Cisco ENCOR 350-401 key terms

A Cisco software-defined campus architecture that separates control and data planes. Edge nodes encapsulate traffic in VXLAN, fabric control-plane nodes map endpoint locations, and border nodes connect the fabric to external networks.

Locator/ID Separation Protocol. It separates an endpoint's identity (EID) from its routing location (RLOC), letting a mapping database resolve where an address currently lives, which enables endpoint mobility inside an SD-Access fabric.

Virtual Extensible LAN with Group Policy Option. It carries Layer 2 frames over UDP with a 24-bit VNI and adds a group policy ID, so SD-Access can enforce scalable security policy per endpoint group rather than per subnet.

An SD-Access role that connects the fabric domain to external networks such as WAN, data center, or legacy campus. It handles VXLAN-to-VLAN handoff and shares endpoint reachability with the fabric control plane.

An SD-Access switch that connects wired or wireless endpoints into the fabric. It registers endpoint addresses with the control plane, encapsulates traffic in VXLAN, and applies group-based policy at ingress.

Scalable Group Tag. A 16-bit value inserted into a packet (for example in the CMD field of an 802.1Q tag or in VXLAN-GPO) that identifies the source security group, enabling policy enforcement independent of IP address or VLAN.

SGT Exchange Protocol. It propagates IP-to-SGT bindings between network devices that cannot natively carry tags, such as older switches or firewalls, so group policy stays consistent across a mixed infrastructure.

Cisco's group-based access control framework. Endpoints are classified into security groups, tagged with SGTs, and permitted or denied by a policy matrix, which decouples enforcement from topology and addressing.

A tunneling technology that encapsulates Layer 2 frames inside UDP packets, typically over a routed IP core. Its 24-bit VNI allows roughly 16 million segments, far beyond VLAN limits, and it underpins modern data center and campus fabrics.

VXLAN Tunnel Endpoint. A device that encapsulates and decapsulates VXLAN traffic. Each VTEP has a local IP used as the tunnel source and maintains mappings of remote VTEPs to reachable VNIs.

VXLAN Network Identifier. A 24-bit segment identifier carried in the VXLAN header that scopes a Layer 2 domain across the tunnel, allowing overlapping MAC and IP addressing between isolated segments.

Ethernet VPN. A BGP address family that distributes MAC and IP reachability plus VTEP information for VXLAN or other overlays, replacing flood-and-learn with control-plane learning and supporting multihoming and fast convergence.

Multiprotocol BGP. An extension of BGP that carries address families beyond IPv4 unicast, such as VPNv4, IPv6, and EVPN. It uses route targets and route distinguishers to keep customer or tenant routes separate.

A BGP extended community that identifies which VRFs should import a route. Export and import policies on route targets control leaking of prefixes between VRFs in MPLS L3VPN and EVPN designs.

Virtual Routing and Forwarding. It creates independent routing tables on one device, allowing overlapping addresses per tenant or function. Interfaces and protocols are assigned to a VRF, and traffic crosses VRFs only through deliberate leaking or a handoff.

Generic Routing Encapsulation. A stateless IP-in-IP style tunnel that can carry many protocols. It adds overhead, has no built-in encryption, and is often paired with IPsec for confidentiality.

A suite of protocols that authenticates and encrypts IP packets. IKE negotiates security associations, AH provides integrity only, and ESP provides confidentiality plus integrity, commonly used for site-to-site and remote-access VPNs.

Internet Key Exchange version 2. It negotiates IPsec security associations using a two-phase exchange, supports built-in NAT traversal and MOBIKE, and is the preferred choice for modern IPsec VPN deployments.

Dynamic Multipoint VPN. A hub-and-spoke design using mGRE and NHRP that lets spokes build direct tunnels to each other on demand, reducing hub load and latency while keeping configuration centralized.

Next Hop Resolution Protocol. In DMVPN it lets a spoke ask the hub for the public address of another spoke, enabling direct spoke-to-spoke tunnels without static peer configuration.

A Cisco IPsec framework built on IKEv2 that uses a unified configuration model for site-to-site, hub-and-spoke, and remote access. It supports per-peer authorization and dynamic virtual access interfaces.

A LISP infrastructure node that receives map requests from ingress tunnel routers and forwards them to the authoritative map server, simplifying client configuration in large fabrics.

Virtual Router Redundancy Protocol. Multiple routers share a virtual IP and MAC; the master forwards traffic while backups monitor it. It is an open standard alternative to HSRP for gateway redundancy.

Hot Standby Router Protocol. A Cisco first-hop redundancy protocol in which an active router and standby router share a virtual IP and MAC. Preemption and interface tracking control which router forwards traffic.

A logical grouping of OSPF interfaces that limits link-state flooding and SPF calculation scope. All areas must touch area 0, the backbone, and inter-area routes are summarized by area border routers.

Area Border Router. An OSPF router with interfaces in two or more areas. It originates type 3 summary LSAs between areas and can summarize or filter prefixes to reduce flooding and table size.

Link-state advertisement categories. Type 1 is router, type 2 network, type 3 summary, type 4 ASBR summary, type 5 external, and type 7 NSSA external. Knowing their scope is essential for troubleshooting OSPF databases.

A backup route whose reported distance is lower than the successor's feasible distance, guaranteeing it is loop-free. It can be promoted immediately when the successor fails, avoiding a new diffusing computation.

Diffusing Update Algorithm. EIGRP's route computation engine that selects successors, tracks feasible successors, and runs a bounded query process only when no loop-free backup exists, keeping convergence fast.

The ordered decision process for choosing one best route among candidates: weight, local preference, locally originated, AS path length, origin, MED, eBGP over iBGP, IGP metric, then router ID. The order matters in exam scenarios.

An iBGP router allowed to reflect routes to other iBGP peers, removing the full-mesh requirement. It uses cluster IDs and originator IDs to prevent loops and needs careful design for redundancy.

A multicast routing mode where traffic flows only after receivers join via a shared rendezvous point tree, then may switch to a shortest-path tree. It scales better than dense mode for sparse groups.

Reverse Path Forwarding check. A router accepts multicast traffic only if it arrives on the interface used to reach the source, preventing loops. Failures usually indicate unicast routing or RPF mismatch.

Multicast Source Discovery Protocol. It shares active source information between PIM domains or rendezvous points, allowing receivers in one domain to join sources in another.

Control Plane Policing. A QoS policy applied to traffic destined for the device's CPU, rate-limiting or dropping excessive control-plane packets to protect routing protocols and management access from DoS or misconfiguration.

A QoS action that meters traffic and drops or remarks packets exceeding a committed rate, typically using a token bucket. It is used at ingress to enforce contracted rates.

A flow telemetry feature that exports records of source, destination, ports, protocol, byte and packet counts. It supports traffic analysis, capacity planning, and security baselining without full packet capture.

Cisco's active probing feature. It sends synthetic probes such as ICMP echo or UDP jitter and tracks reachability, latency, and loss, which can trigger tracking objects that influence static routes or HSRP priority.

Switched Port Analyzer. It copies traffic from source ports or VLANs to a destination port for analysis. RSPAN extends it across a VLAN, and ERSPAN carries it over a GRE tunnel to a remote collector.

A data modeling language that defines the structure, types, and constraints of device configuration and state. It underpins NETCONF and RESTCONF, enabling vendor-neutral, model-driven automation.

A network management protocol that runs over SSH, uses XML-encoded RPCs, and supports candidate configurations and transactional commits. It is the standard choice for reliable, model-driven configuration changes.

A lightweight, HTTP-based protocol that exposes YANG-modeled data using REST methods and JSON or XML. It is easier to integrate with web tooling than NETCONF but offers fewer transactional guarantees.

Embedded Event Manager. A Cisco feature that triggers actions from events such as syslog patterns, timers, or interface changes. It can run CLI commands or Tcl policies for local automation and self-healing.

An agentless automation tool that connects over SSH or API and runs declarative playbooks written in YAML. It is common for pushing configuration and validating state across Cisco devices.

Cisco's controller platform for intent-based networking. It provides design, policy, provisioning, and assurance for campus and branch networks, using templates and telemetry to automate and verify deployments.

A Cisco feature that applies an ACL-like match and an action (forward or drop) to traffic within a VLAN, often used with VLAN filter lists to restrict intra-VLAN communication.

A Layer 2 isolation technique that splits a primary VLAN into isolated and community secondary VLANs, restricting host-to-host communication without separate subnets or ACLs.

Port-based network access control. A supplicant authenticates through a switch to a RADIUS server using EAP; the port stays unauthorized until success, then may be assigned a dynamic VLAN or SGT.

IEEE 802.1AE link-layer encryption and integrity protection for Ethernet frames. It secures hop-by-hop traffic on trusted links, such as switch-to-switch or switch-to-host, without IPsec overhead.

A controller-based WAN architecture with centralized management, orchestration, and control planes. vSmart distributes routes and policy, vBond handles onboarding, and vManage provides configuration and monitoring.