I85PREP
⌘ K
Cisco ENCOR 350-401 study materials
Cisco ENCOR 350-401 study resources

Cisco ENCOR 350-401 practice questions

One question at a time. Build your Cisco ENCOR 350-401 understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Architecture

A campus design uses a two-tier architecture in which each access switch has a redundant link to each of two distribution switches, and the distribution switches run HSRP. Which layer of the Cisco hierarchical model is responsible for policy enforcement and aggregation in this design?

  1. Distribution layer Correct answer.
  2. Core layer
  3. Data center layer
  4. Access layer

Explanation

The distribution layer aggregates access-layer wiring closets and enforces policy such as routing, filtering, and summarization. It is also where first-hop redundancy like HSRP typically runs. The access layer provides endpoint connectivity, while the core provides fast transport between distribution blocks.

Question 2Architecture

Which statement describes the role of the collapsed core in a campus network design?

  1. It removes the need for any redundant links between access and distribution.
  2. It eliminates the need for a routing protocol in the campus.
  3. It places all Layer 3 boundaries at the access layer.
  4. It combines the core and distribution functions into a single layer of switches. Correct answer.

Explanation

A collapsed core design merges the core and distribution layers into one pair of switches, which is common in smaller campuses. Access switches still connect upward to this combined layer. Redundancy and Layer 3 boundaries are design choices independent of collapsing the layers.

Question 3Architecture

A design requires that a single VLAN span two buildings connected by a Layer 2 trunk, while keeping the spanning tree domain small. Which technology best meets this requirement?

  1. Ethernet over MPLS Layer 2 VPN Correct answer.
  2. Cisco FabricPath
  3. VLAN Trunking Protocol pruning
  4. Multichassis EtherChannel

Explanation

An Ethernet over MPLS Layer 2 VPN extends a VLAN across sites without extending the spanning tree domain across the WAN. The provider network forwards frames transparently while each site keeps its own STP topology. VTP and MEC do not solve cross-building Layer 2 extension.

Question 4Architecture

Which two-tier data center design uses separate access and aggregation switches, with servers connected to both access switches for redundancy?

  1. Three-tier campus
  2. Top-of-rack with server NIC teaming
  3. Spine-leaf Correct answer.
  4. Collapsed core

Explanation

A spine-leaf (leaf-spine) design connects every leaf switch to every spine switch, providing predictable latency and redundant paths. Servers dual-home to leaf switches. Collapsed core and three-tier campus are campus models, not the standard data center fabric.

Question 5Architecture

A network engineer must provide loop-free Layer 2 multipathing in a data center without relying on STP. Which Cisco technology is designed for this purpose?

  1. Cisco FabricPath Correct answer.
  2. HSRP
  3. GLBP
  4. Rapid PVST+

Explanation

Cisco FabricPath is a data center fabric technology that provides Layer 2 multipathing using IS-IS-based control plane and does not depend on spanning tree. Rapid PVST+ is an STP variant that blocks redundant links. HSRP and GLBP are first-hop redundancy protocols.

Question 6Architecture

Which VXLAN component provides the mapping between VXLAN segment IDs and the underlying transport network?

  1. VTEP Correct answer.
  2. VNI
  3. Anycast gateway
  4. vPC peer-link

Explanation

A VTEP (VXLAN Tunnel Endpoint) encapsulates and decapsulates frames, mapping the VXLAN VNI to the transport IP network. The VNI identifies the segment but does not perform the mapping function. vPC peer-link and anycast gateway are separate features.

Question 7Architecture

A company wants a single control plane for both underlay and overlay in its VXLAN EVPN fabric. Which protocol is used as the EVPN control plane?

  1. OSPFv3
  2. EIGRP
  3. IS-IS
  4. BGP Correct answer.

Explanation

EVPN uses MP-BGP to distribute MAC and IP reachability information for the overlay. The underlay may run OSPF, IS-IS, or BGP, but EVPN itself is defined as a BGP address family. EIGRP and OSPFv3 do not carry EVPN routes.

Question 8Architecture

Which statement best describes the purpose of the Cisco SD-WAN control plane component?

  1. It distributes routing and policy information to WAN edge devices. Correct answer.
  2. It terminates IPsec tunnels from all branches.
  3. It forwards user traffic between branches.
  4. It provides DHCP services to branch endpoints.

Explanation

In Cisco SD-WAN, the control plane (vSmart controllers) distributes routing and policy information to WAN edge routers using OMP. Data forwarding is performed by the WAN edge devices themselves. DHCP and IPsec termination are separate functions.

Question 9Architecture

In a Cisco SD-WAN deployment, which component authenticates and authorizes WAN edge devices when they join the fabric?

  1. vSmart controller
  2. WAN edge router
  3. vManage
  4. vBond orchestrator Correct answer.

Explanation

The vBond orchestrator handles initial authentication and authorization of WAN edge devices and helps them discover controllers. vSmart distributes policy and routes, vManage provides management, and WAN edge routers forward traffic.

Question 10Architecture

Which Cisco SD-WAN component is responsible for the management plane and centralized configuration?

  1. vSmart
  2. vBond
  3. vManage Correct answer.
  4. vEdge Cloud

Explanation

vManage provides the management plane, including configuration templates, monitoring, and dashboards. vBond handles orchestration and authentication, vSmart handles control plane policy, and vEdge Cloud is a virtual WAN edge device.

Question 11Architecture

Which protocol does Cisco SD-WAN use for the overlay control plane between WAN edge routers and vSmart controllers?

  1. EIGRP
  2. OMP Correct answer.
  3. OSPF
  4. BGP

Explanation

The Overlay Management Protocol (OMP) runs between WAN edge routers and vSmart controllers to exchange routes, TLOCs, and policy. BGP, OSPF, and EIGRP may be used in the underlay or at the service side, but OMP is the SD-WAN overlay control protocol.

Question 12Architecture

An engineer needs to design a first-hop redundancy solution that allows load sharing across multiple gateways while providing a virtual MAC per gateway. Which protocol meets this requirement?

  1. HSRP
  2. VSS
  3. VRRP
  4. GLBP Correct answer.

Explanation

GLBP provides first-hop redundancy and can load-share traffic across multiple gateways, each with its own virtual MAC address. HSRP and VRRP use a single active gateway per group, and VSS is a chassis virtualization technology.

Question 13Architecture

Which statement accurately describes the difference between HSRP and VRRP?

  1. VRRP requires a standby gateway, while HSRP does not.
  2. HSRP supports IPv6, while VRRP does not.
  3. HSRP is an open standard, while VRRP is Cisco proprietary.
  4. VRRP uses a virtual MAC derived from the virtual router ID, while HSRP uses a Cisco-defined virtual MAC. Correct answer.

Explanation

VRRP uses a virtual MAC address based on the virtual router identifier (0000.5E00.01xx), while HSRP uses Cisco-defined virtual MAC addresses. VRRP is an open standard and HSRP is Cisco-developed. Both support IPv6 and both elect a single active gateway per group.

Question 14Architecture

A design uses a Layer 3 access layer with routed links to the distribution layer. What is a primary benefit of this design?

  1. It eliminates the need for spanning tree on access-to-distribution links. Correct answer.
  2. It reduces the number of VLANs required at the access layer.
  3. It requires VTP to propagate VLANs.
  4. It removes the need for a routing protocol.

Explanation

Routed links from access to distribution remove Layer 2 loops, so spanning tree is not needed on those uplinks. A routing protocol is still required to exchange subnets. VLANs still exist at the access layer for endpoint segmentation, and VTP becomes unnecessary.

Question 15Architecture

Which Cisco technology allows two physical switches to operate as a single logical switch for Layer 2 management and control?

  1. StackWise
  2. VSS Correct answer.
  3. vPC
  4. EtherChannel

Explanation

Virtual Switching System (VSS) combines two Catalyst chassis into one logical switch with a single control plane. vPC keeps separate control planes with a peer link. StackWise is a stacking technology, and EtherChannel bundles links but does not merge switches.

Question 16Architecture

In a vPC domain, which interface carries the synchronization of control-plane information and is also used for data traffic when the peer link fails?

  1. vPC member port
  2. vPC peer-link Correct answer.
  3. Keepalive link
  4. Orphan port

Explanation

The vPC peer-link carries control-plane synchronization and normally carries data for orphan and peer-switch traffic. The keepalive link is a separate heartbeat path. Member ports connect to downstream devices, and orphan ports are single-attached.

Question 17Architecture

A network uses vPC between two distribution switches. Which statement about the vPC peer-switch feature is correct?

  1. It requires the peer-link to be a routed port.
  2. It allows both vPC peers to act as active spanning tree root for the vPC domain. Correct answer.
  3. It prevents any single-attached device from forwarding traffic.
  4. It disables spanning tree on the peer-link.

Explanation

Peer-switch allows both vPC peers to act as active STP root, improving convergence and avoiding root election issues. The peer-link remains a trunk, and single-attached devices still forward normally. It does not disable spanning tree.

Question 18Architecture

Which Cisco feature provides a virtual default gateway that is distributed across leaf switches in a VXLAN EVPN fabric, allowing each leaf to route locally?

  1. GLBP
  2. HSRP
  3. Anycast distributed gateway Correct answer.
  4. VRRP

Explanation

The anycast distributed gateway feature gives each leaf switch the same virtual IP and MAC for a subnet so hosts can route locally without tromboning to a single gateway. HSRP, VRRP, and GLBP are traditional first-hop redundancy protocols that centralize the active gateway.

Question 19Architecture

Which statement describes the function of an underlay network in a VXLAN EVPN fabric?

  1. It provides IP reachability between VTEP loopback addresses. Correct answer.
  2. It carries VXLAN-encapsulated frames between VTEPs.
  3. It distributes MAC addresses to all switches.
  4. It replaces BGP with OSPF for overlay signaling.

Explanation

The underlay provides IP connectivity between VTEP loopback interfaces, typically using OSPF, IS-IS, or BGP. VXLAN-encapsulated traffic rides over this reachability. MAC distribution is handled by the EVPN overlay, not the underlay.

Question 20Architecture

Which statement about the Cisco SD-WAN data plane is correct?

  1. Data traffic between branches traverses the vSmart controller.
  2. Data traffic is always routed through the vBond orchestrator.
  3. Data traffic is forwarded directly between WAN edge routers over IPsec tunnels. Correct answer.
  4. Data traffic is forwarded only through the vManage server.

Explanation

In Cisco SD-WAN, WAN edge routers establish IPsec tunnels and forward data directly between sites. Controllers handle orchestration, control, and management but do not sit in the data path. This separation improves scalability.

Question 21Architecture

Which Cisco SD-WAN feature allows a policy to select a path based on application identity rather than only on destination prefix?

  1. BGP route reflection
  2. QoS marking
  3. Policy-based routing
  4. Application-aware routing Correct answer.

Explanation

Application-aware routing (AAR) uses application identification and SLA probes to select the best path per application. Policy-based routing and QoS marking can influence forwarding but do not identify applications. BGP route reflection is unrelated to per-application path selection.

Question 22Architecture

A network engineer is comparing a traditional campus design with a Cisco SD-Access design. Which statement accurately describes an SD-Access fabric?

  1. It relies solely on STP to prevent loops.
  2. It requires manual VLAN configuration on every access switch.
  3. It eliminates the need for any underlay network.
  4. It uses a LISP-based control plane with VXLAN data encapsulation. Correct answer.

Explanation

Cisco SD-Access uses LISP for the control plane and VXLAN for data-plane encapsulation over an IP underlay. It automates segmentation and policy, reducing manual VLAN configuration. It does not rely on STP for loop prevention and still requires an underlay.

Question 23Architecture

Which component of Cisco SD-Access acts as the mapping database between endpoint identifiers and their fabric locations?

  1. Fabric edge node
  2. Control plane node Correct answer.
  3. Border node
  4. Intermediate node

Explanation

The control plane node runs LISP map-server functions and maintains the endpoint-to-location mapping database. Edge nodes encapsulate traffic, border nodes connect to external networks, and intermediate nodes provide underlay transport.

Question 24Architecture

A company is designing a campus network with a requirement for deterministic convergence and fast failure detection on fiber uplinks between buildings. Which technology best meets the requirement?

  1. PortFast on uplinks
  2. STP with default timers
  3. Bidirectional Forwarding Detection with a routing protocol Correct answer.
  4. VTP pruning

Explanation

BFD provides sub-second failure detection that a routing protocol can use to converge quickly. STP default timers are slow, VTP pruning affects flooding, and PortFast should not be applied to uplinks because it skips STP learning.

Question 25Architecture

Which statement about the Cisco three-tier hierarchical model is correct?

  1. The distribution layer provides policy-based connectivity and route summarization. Correct answer.
  2. The core layer enforces access control lists for user traffic.
  3. The access layer connects distribution blocks together.
  4. The core layer connects endpoints to the network.

Explanation

The distribution layer aggregates access switches and applies policy, filtering, and route summarization. The core provides fast transport between distribution blocks, and the access layer connects endpoints. Placing ACLs in the core is generally avoided to keep it fast and simple.

Question 26Architecture

In a Cisco SD-Access fabric, which node type provides the gateway function for a virtual network and performs the first-hop routing for endpoints in that virtual network?

  1. Fabric edge node Correct answer.
  2. Fabric control plane node
  3. Fabric border node
  4. Fabric intermediate node

Explanation

Fabric edge nodes connect endpoints to the fabric and act as the anycast distributed gateway for the virtual networks they serve, performing first-hop routing for those endpoints. Border nodes instead connect the fabric to external networks, and control plane nodes hold the endpoint-to-location mapping database.

Question 27Architecture

An engineer must summarize the 10.10.0.0/16 address space into a single route advertised from an OSPF area border router. Which configuration accomplishes this?

  1. area 0 filter-list prefix SUMMARY in
  2. ip summary-address eigrp 1 10.10.0.0 255.255.0.0
  3. summary-address 10.10.0.0 255.255.0.0
  4. area 0 range 10.10.0.0 255.255.0.0 Correct answer.

Explanation

In OSPF, inter-area summarization is configured on the area border router with the area range command, which collapses the component networks of that area into one summary LSA. The mask is written in dotted decimal form, so 255.255.0.0 corresponds to /16.

Question 28Architecture

A wireless client roams between two access points managed by the same Catalyst 9800 controller. Which statement describes how the client's session is preserved during this intra-controller roam?

  1. The client receives a new IP address from a different VLAN to maintain Layer 3 reachability.
  2. The controller keeps the client's mobility state and security context, so the client is not forced to reauthenticate. Correct answer.
  3. The client is deauthenticated and must re-run the four-way handshake with a new pairwise key from the controller.
  4. The client must perform a full 802.1X reauthentication with the AAA server on the new access point.

Explanation

Within a single controller, roaming is handled internally: the controller maintains the client database including security and QoS context, so the session survives the move to a new access point. Reauthentication and address changes are not required for an intra-controller roam.

Question 29Architecture

A network architect is comparing NETCONF and RESTCONF for programmatic device management. Which statement correctly distinguishes the two?

  1. NETCONF uses XML-encoded RPCs over an SSH transport, while RESTCONF uses HTTP methods with JSON or XML payloads. Correct answer.
  2. Both protocols require SNMP as the underlying transport for retrieving configuration data.
  3. NETCONF uses HTTP verbs such as GET and PATCH, while RESTCONF relies on SSH subsystems and RPC operations.
  4. NETCONF can only read operational state, while RESTCONF can only modify running configuration.

Explanation

NETCONF is an IETF protocol that encodes operations as XML RPCs, typically carried over an SSH session on port 830. RESTCONF maps the same data model concepts onto HTTP methods, returning JSON or XML, which makes it friendlier to web-style tooling.

Question 30Architecture

A company is deploying a Cisco SD-WAN fabric with a strict requirement that only the data plane of the overlay be encrypted with IPsec, while the control plane uses DTLS. Which statement about the default behavior is accurate?

  1. Both control and data plane traffic use DTLS by default, with IPsec added only for multicast traffic.
  2. All overlay tunnels use IPsec by default, and DTLS is only used when IPsec is disabled.
  3. Control plane connections use DTLS by default, and the data plane uses IPsec only when an IPsec-enabled profile or policy is applied. Correct answer.
  4. Neither DTLS nor IPsec is used by default; encryption requires explicit manual configuration on every device.

Explanation

In Cisco SD-WAN, the control plane (vSmart and vBond connections) is secured with DTLS by default, while data plane traffic between WAN edges is encrypted with IPsec when the devices are configured with IPsec, which is part of the default templates in current releases. The distinction matters because control and data plane encryption are separate settings.

Question 31Virtualization

In a Cisco SD-Access fabric, which device role encapsulates user traffic in VXLAN and performs the Layer 3 lookup for endpoints in its own fabric site?

  1. Fabric intermediate node
  2. Fabric control plane node
  3. Fabric edge node Correct answer.
  4. Fabric border node

Explanation

Edge nodes connect wired and wireless endpoints to the fabric, register them with the control plane, and encapsulate traffic toward other fabric devices using VXLAN with a Layer 3 VNI or Layer 2 VNI as appropriate. They also act as the first-hop gateway for endpoints in their site.

Question 32Virtualization

Which Cisco SD-WAN component is responsible for distributing policies and configuration templates to the WAN edge routers?

  1. vBond orchestrator
  2. WAN edge router
  3. vSmart controller Correct answer.
  4. vManage NMS

Explanation

The vSmart controller holds the centralized control plane: it receives OMP routes from WAN edges, applies centralized policy, and distributes the resulting routing and policy information. It is also the component that pushes policy definitions to the edges.

Question 33Virtualization

What is the purpose of the VXLAN network identifier (VNI) in a VXLAN header?

  1. It is used as the outer destination IP address for the encapsulated packet.
  2. It identifies the Layer 2 or Layer 3 segment to which the encapsulated frame belongs, allowing up to 16 million segments. Correct answer.
  3. It is a 12-bit field that identifies the VLAN on the underlay transport switches.
  4. It carries the original source MAC address so the egress VTEP can forward the frame.

Explanation

The VNI is a 24-bit field in the VXLAN header that segments the overlay into isolated broadcast domains or VRFs, far exceeding the 12-bit VLAN limit. VTEPs use it to decide which local bridge domain or VRF receives the decapsulated frame.

Question 34Virtualization

A network engineer wants to verify that a Cisco Catalyst 9000 switch has formed a LISP session with the fabric control plane node. Which command shows the LISP map-server peer state?

  1. show fabric control-plane
  2. show vxlan vtep
  3. show lisp instance-id 0 ipv4 database
  4. show lisp session Correct answer.

Explanation

The 'show lisp session' command lists LISP peering sessions, their state, and the addresses of the map-server and map-resolver peers. A healthy fabric edge should show a session in the 'open' state with the control plane node.

Question 35Virtualization

Which statement describes the role of the LISP map-resolver in an SD-Access fabric?

  1. It answers map-requests from fabric edge nodes by returning the locator of the edge that registered the requested endpoint. Correct answer.
  2. It authenticates fabric edge nodes before they can join the control plane.
  3. It stores the endpoint database and replicates it to every edge node in the fabric.
  4. It performs the VXLAN encapsulation of traffic between fabric sites.

Explanation

The map-resolver receives map-request messages and forwards them to the map-server that holds the matching endpoint record; the reply contains the RLOC (the edge node's locator). This lets an ingress edge learn where a destination endpoint is attached without flooding.

Question 36Virtualization

An engineer configures a VXLAN tunnel interface on a Nexus 9000 switch. Which command is required to associate a VLAN with a VNI for a distributed anycast gateway?

  1. interface nve1 / member vni 10010
  2. interface Ethernet1/1 / switchport vlan mapping 10 10010
  3. vrf context tenant1 / vni 10010
  4. vlan 10 / vn-segment 10010 Correct answer.

Explanation

Under the VLAN configuration, the 'vn-segment' command maps the VLAN to a VNI, which is the first step in building the VXLAN bridge domain. The VNI is then associated with the NVE interface and, for Layer 3, with a VRF.

Question 37Virtualization

What is the primary function of the Cisco SD-WAN OMP protocol?

  1. It manages device images and configuration templates from vManage.
  2. It performs NAT traversal for devices behind firewalls.
  3. It distributes routes, TLOCs, and policies between WAN edge routers through the vSmart controllers. Correct answer.
  4. It provides IPsec encryption for all traffic traversing the WAN.

Explanation

Overlay Management Protocol runs between WAN edges and vSmart controllers, carrying route prefixes, TLOC attributes, and centralized policy. It is the control plane that builds the overlay topology independent of the underlying transport.

Question 38Virtualization

A vEdge router has two WAN transports, one MPLS and one internet. An engineer wants voice traffic to prefer MPLS but fail over to internet when MPLS latency exceeds 150 ms. Which SD-WAN feature implements this?

  1. Static route with a floating administrative distance
  2. QoS shaping on the internet transport
  3. Policy-based routing applied on the LAN interface
  4. Application-aware routing with an SLA class and a preferred TLOC Correct answer.

Explanation

Application-aware routing uses SLA classes with criteria such as latency, loss, and jitter, and the best-path selection chooses among TLOCs that satisfy the SLA. A preferred TLOC or explicit priority makes MPLS the first choice while keeping internet as a backup.

Question 39Virtualization

Which Cisco SD-WAN component is responsible for authenticating WAN edge routers and providing them with the address of the vSmart controllers?

  1. vSmart controller
  2. vBond orchestrator Correct answer.
  3. WAN edge router
  4. vManage NMS

Explanation

The vBond orchestrator validates the identity of edge devices, handles NAT traversal, and returns the list of vSmart and vManage addresses so the edge can join the overlay. It is the initial point of contact for onboarding.

Question 40Virtualization

In a Cisco SD-Access fabric, which node provides the Layer 3 handoff to a traditional external network and can also extend the fabric to another site?

  1. Fabric edge node
  2. Fabric control plane node
  3. Fabric border node Correct answer.
  4. Fabric wireless controller

Explanation

Border nodes connect the fabric to external Layer 3 networks and, when configured as a border with the appropriate handoff, connect multiple fabric sites together. They also perform the VXLAN-to-VLAN or VXLAN-to-VXLAN translation required at the boundary.

Question 41Virtualization

What does a VXLAN VTEP do when it receives a frame destined to a MAC address it has not learned?

  1. It encapsulates the frame and sends it to the underlay multicast group or to a configured head-end replication list for that VNI. Correct answer.
  2. It sends the frame to the control plane node for MAC resolution.
  3. It floods the frame out all physical ports in the underlay VLAN.
  4. It drops the frame and sends an ARP request to the underlay router.

Explanation

Unknown unicast, broadcast, and multicast traffic in a VXLAN bridge domain is replicated to all VTEPs that participate in the VNI. This is done either through underlay multicast or through ingress replication using a head-end replication list.

Question 42Virtualization

Which Cisco SD-WAN policy type is used to control which routes are advertised to and accepted from specific sites?

  1. Application-aware routing policy
  2. Centralized route policy Correct answer.
  3. Local data policy
  4. Centralized access policy

Explanation

Centralized route policy is applied on vSmart controllers and uses site lists, prefix lists, and VPN membership to control route advertisement and acceptance. Access policy, by contrast, controls traffic forwarding between VPNs or sites.

Question 43Virtualization

A network designer is choosing between VXLAN and traditional VLANs for a data center. Which advantage is specific to VXLAN?

  1. It eliminates the need for a routing protocol in the underlay.
  2. It provides a 24-bit segment identifier that scales beyond the 4094 VLAN limit and stretches Layer 2 over a Layer 3 underlay. Correct answer.
  3. It requires no MAC address learning on the VTEPs.
  4. It provides native encryption of the encapsulated payload.

Explanation

VXLAN uses a 24-bit VNI for roughly 16 million segments and tunnels Layer 2 frames over a routable Layer 3 underlay. This allows large multitenant designs and Layer 2 extension across routed networks.

Question 44Virtualization

Which command on a Cisco Nexus 9000 verifies the VXLAN VNI-to-VLAN mapping and the state of the NVE interface?

  1. show ip route vrf all
  2. show vlan brief
  3. show nve vni Correct answer.
  4. show interface nve1

Explanation

The 'show nve vni' command lists each VNI, its associated VLAN or VRF, and whether it is up and attached to the NVE interface. It is the standard verification for VXLAN segment status.

Question 45Virtualization

In a Cisco SD-Access fabric, what is the function of the fabric control plane node's map-server?

  1. It provides DHCP and DNS services to endpoints.
  2. It forwards all data traffic between fabric sites.
  3. It stores endpoint-to-edge-node mappings and answers map-requests from edge nodes. Correct answer.
  4. It authenticates endpoints using 802.1X before they join the fabric.

Explanation

The map-server holds the endpoint database, registering EID-to-RLOC mappings from edge nodes and responding to map-requests. This allows the ingress edge to learn the destination edge's locator without flooding.

Question 46Virtualization

Which Cisco SD-WAN feature allows a branch router to use a public internet link for direct site-to-site tunnels without routing traffic through a hub?

  1. Service-side VPN with no TLOC configured
  2. Direct internet access with TLOC extension and on-demand or full-mesh tunnels Correct answer.
  3. Static IPsec tunnels with a single hub
  4. Hub-and-spoke topology with a centralized data center

Explanation

SD-WAN builds full-mesh or on-demand tunnels between TLOCs, so branches can communicate directly over the internet without transiting a hub. This reduces latency and hub bandwidth consumption.

Question 47Virtualization

What is the purpose of the anycast gateway in a VXLAN EVPN fabric?

  1. It provides a single physical gateway that all traffic must traverse.
  2. It replaces the need for VXLAN encapsulation on the leaf switches.
  3. It assigns different gateway IP addresses to each leaf to avoid conflicts.
  4. The same gateway IP and MAC are configured on every leaf so hosts can use a consistent default gateway regardless of their location. Correct answer.

Explanation

With anycast gateway, every leaf uses the same gateway IP and virtual MAC for a given subnet, so a host keeps its default gateway when it moves between leaves. Traffic is always routed locally at the ingress leaf.

Question 48Virtualization

An engineer wants to extend a VLAN across two data centers connected by a Layer 3 underlay using VXLAN EVPN. Which two components are required on each leaf? (Choose the option that lists both.)

  1. A physical trunk between the data centers and a spanning-tree domain
  2. A VRF with no VNI and an OSPF adjacency to the remote leaf
  3. An NVE interface with a VNI and a BGP EVPN address family peering with the spine Correct answer.
  4. A single VLAN with no VNI and a static route to the remote data center

Explanation

VXLAN EVPN requires an NVE interface to encapsulate traffic for the VNI and a BGP EVPN control plane to advertise MAC and IP reachability. The underlay provides IP reachability between VTEP loopbacks.

Question 49Virtualization

What is the function of the Cisco SD-WAN TLOC?

  1. It is the certificate used to authenticate edge devices.
  2. It identifies the VPN segment to which a route belongs.
  3. It identifies a specific WAN transport interface on an edge router by system IP, color, and encapsulation. Correct answer.
  4. It is the public IP address of the vBond orchestrator.

Explanation

A TLOC is the tuple of system IP, color (transport), and encapsulation that uniquely identifies a WAN interface in the overlay. OMP routes reference TLOCs so the controller can advertise reachability over specific transports.

Question 50Infrastructure

A switch port is configured with the command 'switchport port-security violation restrict'. What happens when a frame arrives from a MAC address that is not in the secure address table and the maximum has been reached?

  1. The frame is dropped, a violation counter is incremented, and a syslog or SNMP trap is generated. Correct answer.
  2. The frame is forwarded and the new MAC address is added to the secure table automatically.
  3. The interface is placed into the err-disabled state and must be manually recovered.
  4. The frame is dropped silently with no logging or counter increment.

Explanation

Port security supports three violation modes. In restrict mode, offending frames are dropped and the switch records the violation through the port-security violation counter and optional syslog/SNMP notification, while the port stays up. This differs from protect mode, which drops silently, and shutdown mode, which err-disables the port.