Skip to content
Log in Sign up My account

ENCOR Question Bank, Part 2 (Domains 4 to 6)

This is the second half of the ENCOR 350-401 v1.2 practice bank. It holds 50 original questions, numbered 56 to 105, covering 4.0 Network Assurance, 5.0 Security, and 6.0 Automation and Artificial Intelligence. Part 1 (questions 1 to 55) covers domains 1 to 3.

Answer each question before you open the explanation. Many questions are exhibit-based, so practice reading configurations, show output, code and JSON carefully. Target: 40 of 50 (80%).

4.0 Network Assurance

56. Refer to the exhibit. Which two messages are sent to the syslog server at 10.1.1.50? (Choose two.)

Blueprint 4.1

logging host 10.1.1.50
logging trap warnings
logging buffered informational
  • A. %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down
  • B. %SYS-5-CONFIG_I: Configured from console by admin on vty0
  • C. %SYS-2-MALLOCFAIL: Memory allocation of 65536 bytes failed
  • D. %SEC-6-IPACCESSLOGP: list EDGE-IN denied tcp 192.0.2.7(51544) -> 10.1.1.1(23), 1 packet
  • E. %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
Answer: C, E

The number in the middle of the mnemonic is the severity. logging trap warnings sends severity 4 (warnings) and everything more severe (0 to 4) to the server. The LINK message is severity 3 (errors) and the MALLOCFAIL message is severity 2 (critical), so both are sent. Severity 5 and 6 messages (A, B and D) go to the local buffer because it is set to informational, but they are not sent to the server.

Exam trap

A lower severity number means a more serious event. Each logging destination has its own level, so the buffer and the syslog server can capture different sets of messages.

57. An engineer must debug a problem that affects only one interface on a busy core router. The engineer wants to avoid overloading the CPU with debug output from all other interfaces. What is the best approach?

Blueprint 4.1

  • A. Enable the debug, then run terminal monitor so output only appears on the current VTY session
  • B. Enable logging console debugging so the output is rate limited
  • C. Configure debug condition interface for that interface before enabling the debug
  • D. Enable the debug and immediately run undebug all after a few seconds
Answer: C

A conditional debug limits debug processing and output to traffic that matches the condition, such as an interface, an IP address or a username. That is what keeps the CPU load down on a busy router. terminal monitor (A) only changes where output is displayed, not how much is generated. Logging debug output to the console (B) makes the CPU problem worse, because console output is slow. D still floods the router while the debug runs.

58. Refer to the exhibit. What is the most likely explanation for hop 3?

Blueprint 4.1

R1# traceroute 192.0.2.10 numeric
Type escape sequence to abort.
Tracing the route to 192.0.2.10
VRF info: (vrf in name/id, vrf out name/id)
  1 10.1.12.2 1 msec 1 msec 1 msec
  2 10.1.23.3 2 msec 1 msec 2 msec
  3  *  *  *
  4 192.0.2.10 3 msec 2 msec 3 msec
  • A. The device at hop 3 is dropping all traffic to 192.0.2.10
  • B. There is a routing loop between hop 2 and hop 3
  • C. 192.0.2.10 is not reachable and the hop 4 entry is a cached result
  • D. The device at hop 3 forwards traffic but does not send ICMP time-exceeded messages back to R1, or they are filtered
Answer: D

Traceroute sends probes with increasing TTL values, and each router that decrements the TTL to zero should return an ICMP time-exceeded message. Hop 4 (the destination) answered, so the path through hop 3 forwards traffic. The asterisks mean only that hop 3 did not return its ICMP messages, usually because of ICMP rate limiting or an ACL. A is wrong because the destination replied. A routing loop (B) would show the same addresses repeating.

59. Refer to the exhibit. An NMS is configured to poll the router as SNMPv3 user monitor with SHA authentication and the correct authentication password, but with no privacy settings. Polling fails. What is the cause?

Blueprint 4.1

snmp-server group NETOPS v3 priv
snmp-server user monitor NETOPS v3 auth sha Auth#Pass1 priv aes 128 Priv#Pass1
snmp-server host 10.1.1.60 version 3 priv monitor
  • A. SNMPv3 does not support SHA authentication on IOS XE
  • B. The group requires the authPriv security level, but the NMS is using authNoPriv
  • C. The snmp-server host command blocks polling from 10.1.1.60
  • D. The user must be in a group configured with noauth
Answer: B

The priv keyword on the group sets the security level to authPriv, which needs both authentication and encryption. The NMS sends authNoPriv requests, which do not meet the group's level, so the router rejects them. SHA is supported (A). The snmp-server host command defines where traps or informs are sent; it does not control polling (C). Using noauth (D) would weaken security and is not required.

60. Refer to the exhibit. Two packets arrive on Gi0/1 from 10.1.1.5 to 10.2.2.9 with TCP destination port 443. The first uses source port 50001 and the second uses source port 50002. How does the router record them?

Blueprint 4.2

flow record APP-REC
 match ipv4 source address
 match ipv4 destination address
 match transport destination-port
 collect counter bytes
 collect counter packets
!
flow exporter EXP1
 destination 10.1.1.70
 transport udp 2055
!
flow monitor MON1
 record APP-REC
 exporter EXP1
!
interface GigabitEthernet0/1
 ip flow monitor MON1 input
  • A. As two flows, because the source ports differ
  • B. They are not recorded, because the monitor is applied only to output traffic
  • C. They are not recorded, because the record has no match ipv4 protocol field
  • D. As one flow, with the packet and byte counters including both packets
Answer: D

In Flexible NetFlow, match statements define the key fields and collect statements define non-key fields. A new flow is created only when a key field value changes. The source port is not a key field, so both packets share the same key (source address, destination address, destination port) and are counted in one flow. A protocol key field is optional (C). The monitor is applied with the input keyword (B).

Free account required for the rest

This page has 50 questions and the first 5 are shown here. You're seeing a free sample. A free account unlocks everything: every question bank, the timed exams, the cram sheets, the simulations and the lab files.

Create a free account Log in