I85PREP
⌘ K
Cisco ENCOR 350-401 study materials
Cisco ENCOR 350-401 study resources

Cisco ENCOR 350-401: Network Assurance

Cisco ENCOR 350-401 · Work through your exam, one topic at a time.

All guide sections

Network Assurance

Network Assurance (about 10%) tests whether you can find the fault and prove the fix: structured troubleshooting, show/debug/packet-level tools, flow and telemetry data, and controller-based assurance.

Troubleshooting method and tools

  • Define the problem in measurable terms, gather facts, analyze, eliminate causes, propose and test a hypothesis, then document. Change one variable at a time.
  • ping tests reachability and round-trip; extended ping can set source, size, DF, and repeat count. traceroute shows the path but routers may rate-limit ICMP/UDP replies.
  • show commands are safe; debug is CPU-intensive and should be time-bounded and ACL-filtered. Conditional debug and show tech-support collect evidence without flooding the console.
  • SPAN copies traffic from a source port/VLAN to a destination port; RSPAN carries it over a VLAN; ERSPAN encapsulates it over IP. The destination port does not forward normal traffic.
  • NetFlow/Flexible NetFlow reports flow metadata, not full packets. SNMP polls or receives traps; syslog sends event messages. IP SLA generates synthetic probes (ICMP, UDP jitter, HTTP) and can track objects for routing/FHRP.

Controller-based assurance

Cisco DNA Center Assurance collects telemetry from fabric devices and clients, computes health scores, and correlates issues. Model-driven telemetry pushes structured data periodically or on change, unlike SNMP polling. gRPC/gNMI is a common transport.

Worked example

Users report poor voice quality on a WAN link but ping loss is near zero. Check interface errors and QoS drops, then use IP SLA UDP jitter to measure delay, jitter, and loss; use NetFlow to identify the voice flows and competing bulk traffic. A clean ping does not prove voice quality because ping does not measure jitter and is too small to exercise queueing. Reasoning: the symptom is quality, not reachability, so test the metric that matters and look for congestion/policing.

Traps

  • Leaving debug all running on a production device.
  • Thinking SPAN captures traffic on the destination port's normal path; it mirrors.
  • Confusing SNMP traps (unsolicited) with polls (requested).
  • Assuming NetFlow captures payload; it does not.
  • Treating syslog severity 0 as least severe; it is most severe (emergency).