Skip to content

Cisco CCNP Enterprise ENCOR (350-401) - Practice Questions

15 questions across the ENCOR blueprint: architecture, virtualization, infrastructure (the largest section, covering switching, routing, and wireless), network assurance, security, and automation.

Cert page: exams/cisco/ccnp-enterprise-encor-350-401/

Question 1

Scenario: Which OSPF LSA type describes a summary route into an area from an ABR?

A. Type 1 B. Type 3, the summary LSA generated by an area border router C. Type 5 D. Type 7

Answer **Correct: B** **Why:** Type 1 and 2 stay within an area, Type 3 carries inter-area routes from the ABR, Type 5 carries external routes from an ASBR, and Type 7 is the NSSA form of an external route that the ABR translates back to Type 5.

Question 2

Scenario: A switch must load balance traffic across two uplinks to the same neighbor as one logical link.

A. Spanning tree B. An EtherChannel using LACP, with matching speed, duplex, and mode on both ends C. Two separate VLANs D. HSRP

Answer **Correct: B** **Why:** Spanning tree would block the redundant link; bundling makes both forward as one logical interface. Load balancing is per flow based on a hash, so a single large flow does not split across members regardless of the hashing method chosen.

Question 3

Scenario: Which first hop redundancy protocol is a Cisco proprietary protocol with an active and standby router?

A. VRRP B. HSRP, with active and standby roles and a virtual IP C. GLBP only D. LACP

Answer **Correct: B** **Why:** VRRP is the open standard with master and backup roles, and GLBP adds load balancing across multiple forwarders. HSRP's preemption is off by default, which is the behavior detail that surprises people after a failover.

Question 4

Scenario: Traffic between two VLANs on the same switch must be routed.

A. A trunk to a router only B. Switched virtual interfaces on a multilayer switch, with IP routing enabled C. An access port D. A separate switch

Answer **Correct: B** **Why:** SVIs route in hardware on the switch, which is why inter-VLAN routing moved off the router. Router-on-a-stick with subinterfaces over a trunk is the older design and puts every inter-VLAN packet across one physical link.

Question 5

Scenario: Which BGP attribute is evaluated first in the best path selection?

A. Local preference B. Weight, which is Cisco proprietary and local to the router C. AS path length D. MED

Answer **Correct: B** **Why:** The order runs weight (highest wins, local only), then local preference (highest, within the AS), then locally originated, then shortest AS path, then origin, then MED (lowest). Weight never leaves the router, which is what makes it a per-router override.

Question 6

Scenario: A wireless client roams between APs on different subnets without dropping its session.

A. Layer 2 roaming B. Layer 3 roaming with an anchor controller maintaining the client's original subnet C. A new DHCP lease D. Not supported

Answer **Correct: B** **Why:** Layer 2 roaming keeps the client in the same subnet and needs no tunnel. Crossing subnets requires the traffic to be tunneled back to the anchor so the client's IP stays valid, which is why anchor and foreign controller roles exist.

Question 7

Scenario: Which overlay technology does Cisco SD-Access use for the data plane?

A. GRE B. VXLAN, with LISP for the control plane and Cisco TrustSec for policy C. MPLS D. IPsec only

Answer **Correct: B** **Why:** The three-plane split is the point: VXLAN carries the encapsulated traffic and its VNI, LISP maps endpoint identifiers to locators, and scalable group tags carry policy independently of IP addressing.

Question 8

Scenario: Network device configuration must be automated across many devices.

A. Manual CLI on each B. Model-driven programmability: NETCONF or RESTCONF with YANG models, driven by Ansible or a Python script C. TFTP config copies D. SNMP writes

Answer **Correct: B** **Why:** NETCONF over SSH with XML and RESTCONF over HTTPS with JSON both operate on structured YANG models, so a change is validated against a schema rather than screen-scraped. SNMP writes are rarely used for configuration and lack transactional semantics.

Question 9

Scenario: Which mechanism provides real-time streaming of device telemetry?

A. SNMP polling B. Model-driven telemetry, where the device pushes data on a subscription with either a periodic or on-change cadence C. Syslog D. NetFlow only

Answer **Correct: B** **Why:** Polling scales poorly and its resolution is bounded by the poll interval. Push-based telemetry with dial-in or dial-out subscriptions gives higher-frequency data at lower device cost, which is what modern assurance platforms consume.

Question 10

Scenario: A packet capture is needed on traffic passing through a switch port.

A. A tap only B. SPAN for local monitoring, RSPAN across a VLAN, or ERSPAN to a remote destination over IP C. NetFlow D. Syslog

Answer **Correct: B** **Why:** SPAN copies frames to a monitor port; ERSPAN encapsulates them in GRE so the analyzer can live anywhere routable. NetFlow gives flow records rather than packets, which answers who talked to whom but not what was in the packets.

Question 11

Scenario: Which QoS model provides per-hop behavior based on packet marking?

A. Best effort B. DiffServ, where DSCP markings select a per-hop behavior at each device C. IntServ with RSVP D. No QoS

Answer **Correct: B** **Why:** DiffServ scales because each hop acts on the marking without holding per-flow state. IntServ reserves resources per flow with RSVP and does not scale to a large network, which is why DiffServ is what enterprise designs use.

Question 12

Scenario: A device must authenticate users against a central server for network access.

A. Local accounts B. 802.1X with RADIUS to an identity service, falling back to MAB for devices that cannot do 802.1X C. TACACS+ for network access D. No authentication

Answer **Correct: B** **Why:** RADIUS handles network access authentication and authorization together, while TACACS+ separates them and is used for device administration. MAC authentication bypass is the fallback for printers and similar devices, and it is weak because MAC addresses are trivially spoofed.

Question 13

Scenario: Which spanning tree feature protects against a switch being connected to an access port?

A. PortFast alone B. BPDU Guard, which errdisables a PortFast port that receives a BPDU C. Root Guard D. Loop Guard

Answer **Correct: B** **Why:** BPDU Guard shuts the port when something that speaks spanning tree appears where an end host should be. Root Guard is the different case of preventing a legitimate switch from becoming root through that port.

Question 14

Scenario: A GRE tunnel must carry traffic securely over the internet.

A. GRE alone B. GRE over IPsec, since GRE provides no confidentiality by itself C. IPsec cannot carry GRE D. A VLAN

Answer **Correct: B** **Why:** GRE encapsulates and supports multicast and routing protocols; IPsec encrypts but in tunnel mode does not natively carry multicast. Combining them is what makes a routed, encrypted overlay, and it is the basis of DMVPN.

Question 15

Scenario: Which virtualization technology allows one physical device to appear as multiple logical devices?

A. VLANs B. Virtual Routing and Forwarding instances for routing table separation, and device contexts or VDCs for full logical separation C. Trunking D. EtherChannel

Answer **Correct: B** **Why:** VRFs separate routing tables on shared hardware, which is what makes overlapping address space between tenants possible. VLANs segment at layer 2 only and share a single routing table unless VRFs are added.

Where to go deeper