Cisco CCNP 350-401 ENCOR Practice Questions with Explanations

Correct answer: A

The RIB (Routing Information Base) is the control plane routing table that stores all routing information learned from routing protocols. The FIB (Forwarding Information Base) is derived from the RIB and is used by the data plane for actual packet forwarding decisions. The FIB is populated based on the best routes selected from the RIB, making A the correct answer.

Why the other options are wrong:

• B. The FIB does not maintain a mirror image of the RIB; rather, the RIB contains more routing information than what appears in the FIB, which only holds the best routes.
• C. The RIB is not used for switching decisions; the FIB performs the actual forwarding based on IP prefix lookups.
• D. The RIB, not the FIB, is where all routing information is stored; the FIB only contains selected best routes for forwarding.

Correct answer: C

Marking is the QoS component that alters packets by changing fields such as DSCP, IP Precedence, or CoS values to indicate how the traffic should be treated. This modification happens within the packet itself and allows downstream devices to recognize and handle the traffic according to the marked priority.

Why the other options are wrong:

• A. Policing enforces rate limits and drops or marks traffic that exceeds thresholds; it does not alter packet headers for treatment purposes.
• B. Classification identifies and categorizes traffic into groups but does not alter the packets themselves.
• D. Shaping buffers and queues excess traffic but does not modify packet contents to change how traffic is treated.

Correct answer: C

CEF operates in the data plane and maintains two key tables: the FIB (Forwarding Information Base) for IP lookups and the adjacency table for next-hop information. These tables enable fast, hardware-based forwarding decisions without CPU involvement, which is the core benefit of CEF.

Why the other options are wrong:

• A. CEF is designed to remove CPU involvement in packet switching; forwarding decisions are made in the data plane without CPU intervention.
• B. CEF does not use a cache; it uses the FIB and adjacency tables, which are deterministic lookup structures rather than cache-based.
• D. CEF makes forwarding decisions through distributed, hardware-based lookups in the data plane, not through IOS scheduler-based processes.

Correct answer: D

Lower latency between physically co-located systems is a key benefit of on-premises infrastructure. When systems are located near each other in the same data center, network latency is minimized compared to cloud deployments where resources may be geographically distributed or remotely hosted.

Why the other options are wrong:

• A. This is a benefit of cloud infrastructure, not on-premises; cloud allows rapid scaling without physical hardware installation.
• B. On-premises deployments typically require more power and cooling resources than cloud, as you maintain all hardware yourself.
• C. Cloud deployments enable faster deployment times; on-premises requires purchasing and installing physical hardware first.

Correct answer: B

Traffic shaping alleviates congestion by buffering and queuing packets that exceed the committed rate, delaying them rather than dropping them immediately. This smooths traffic flow and prevents sudden bursts from overwhelming network links, allowing congestion to be managed gracefully.

Why the other options are wrong:

• A. Dropping packets is a characteristic of policing, not shaping; shaping buffers excess traffic instead.
• C. Traffic shaping does not fragment packets; it queues whole packets to regulate their transmission rate.
• D. Random packet dropping from lower priority queues describes RED (Random Early Detection) or tail-drop behavior, not shaping mechanisms.

Correct answer: A

The vBond controller handles the orchestration plane in Cisco SD-WAN. It is responsible for device authentication, certificate management, and orchestrating the control connections between vSmart controllers and WAN edge devices. The vBond enables the overlay network to function properly.

Why the other options are wrong:

• B. vSmart is the control plane component that maintains routing policies and establishes control connections with edge devices.
• C. vManage is the management and analytics plane component for monitoring and configuring the SD-WAN deployment.
• D. WAN Edge represents the data plane devices that forward traffic according to policies learned from the control plane.

Correct answer: B

The vSmart controller is the centralized control plane component in Cisco SD-WAN that manages all control plane functions, including policy distribution, routing decisions, and network intelligence. It communicates with WAN Edge nodes to direct how they should forward traffic and handle network operations.

Why the other options are wrong:

• A. Authentication and authorization are handled by other components like vManage and ISE, not vSmart.
• C. While vSmart is centralized, it specifically manages the control plane, not the overall network management system (that role belongs to vManage).
• D. The data plane is managed by WAN Edge nodes; vSmart manages the control plane.

Correct answer: B

In Cisco SD-Access, the Identity Services Engine (ISE) is the policy decision point that performs authentication, authorization, and accounting for all devices connecting to the fabric, including wired clients connecting through edge switches. ISE evaluates the client's identity and applies appropriate network access policies.

Why the other options are wrong:

• A. The edge node forwards traffic but does not make access control decisions.
• C. RADIUS is an authentication protocol that ISE may use, but ISE itself is the decision- making component.
• D. The control-plane node manages fabric control functions but does not directly authorize individual client access.

Correct answer: D

Cloud infrastructure provides efficient scalability through elastic resource provisioning-the ability to quickly add or remove resources based on demand without significant capital investment or physical infrastructure changes. On-premises deployments require purchasing and installing physical hardware, making scaling slower and less efficient.

Why the other options are wrong:

• A. Both cloud and on-premises deployments support virtualization technologies.
• B. Both cloud and on-premises can support various systems; this is not a distinguishing factor.
• C. Storage capacity can be scaled in both environments; cloud offers elastic scaling, but on-premises can add storage as well.

Correct answer: C

distribute policies that govern data forwarding performed within the Cisco SD-WAN fabric The vSmart controller's primary responsibility is to distribute policies and control information that govern how WAN Edge nodes forward data traffic within the SD-WAN fabric. It serves as the policy engine that communicates routing and forwarding decisions to all edge nodes.

Why the other options are wrong:

• A. Onboarding of WAN Edge nodes is performed by the vBond orchestrator, not vSmart.
• B. Telemetry data gathering is the responsibility of vManage, the management plane component.
• D. Configuration and status management is handled by vManage, not vSmart.

Correct answer: C

Radio Resource Management (RRM) in Cisco SD-Access wireless deployments is performed by the wireless controller. The wireless controller manages all RF-related functions including channel assignment, power control, load balancing, and interference mitigation for access points in the fabric.

Why the other options are wrong:

• A. DNA Center is the management and provisioning platform but does not perform real- time RRM functions.
• B. The control plane node manages fabric control functions but not wireless RF-specific RRM operations.
• D. Cisco CMX is a location analytics and mobile experience platform, not the RRM engine.

Correct answer: D

The RIB (Routing Information Base) contains all routing information learned from various routing protocols and may include multiple routes to the same destination prefix with different metrics or costs. The FIB (Forwarding Information Base) is derived from the RIB and contains only the best route selected for each destination, which is actually used for packet forwarding.

Why the other options are wrong:

• A. This reverses the definitions; the FIB is the actual forwarding table, and the RIB contains multiple routes.
• B. This is backwards; the RIB includes many routes and the FIB contains the best route, but the wording about 'single destination' is imprecise.
• C. The RIB does not create topologies; rather, it stores learned routes, and the FIB is the table used for forwarding, not a list of all routes.

Correct answer: D

The overlay network in Cisco SD-Access provides Layer 2 and Layer 3 logical network segments that operate on top of the physical underlay network infrastructure. It uses technologies like VXLAN to create scalable, multi-tenant virtual networks that are independent of the physical topology.

Why the other options are wrong:

• A. The underlay network is the physical infrastructure layer, not the logical network layer.
• B. VPN routing/forwarding (VRF) is a routing technique but does not specifically describe the SD-Access L2/L3 logical network architecture.
• C. Easy Virtual Network (EVN) is not the technology used in SD-Access for creating logical networks.

Correct answer: C

Cisco Express Forwarding (CEF) uses precomputed data structures-the FIB (Forwarding Information Base) and adjacency table-to make fast forwarding decisions for each packet. Process switching, by contrast, looks up each packet's destination in the routing table (slower, CPU-intensive process) and processes the packet in software, effectively 'punting' it for individual processing.

Why the other options are wrong:

• A. CEF handles standard packets efficiently; complex packets may be process- switched, but this is not the primary difference.
• B. Process switching is actually slower than CEF, not faster; CEF is designed for speed through hardware-assisted forwarding.
• D. CEF is less CPU-intensive than process switching; it offloads forwarding decisions to hardware, whereas process switching uses the CPU.

Correct answer: D

LISP (Locator/ID Separation Protocol) is the control plane protocol used in Cisco SD- Access fabric for mapping and resolving endpoints. LISP provides the mechanism to map endpoint identifiers (EIDs) to routing locators (RLOCs), enabling dynamic endpoint location discovery and mobility across the fabric.

Why the other options are wrong:

• A. DHCP is a data plane protocol used for IP address assignment, not for endpoint mapping in SD-Access.
• B. VXLAN is an encapsulation protocol used for data plane tunneling, not for endpoint mapping and resolution.
• C. SXP (Scalable Group Tag eXchange Protocol) is used for tag propagation in SD- Access, not for endpoint mapping.

Correct answer: A

The fabric control plane node (typically the LISP Map Server/Map Resolver) manages endpoint ID to edge node bindings in a Cisco SD-Access wireless architecture. This device maintains the mapping database that tracks which endpoints are reachable through which edge nodes, enabling proper routing and mobility within the fabric.

Why the other options are wrong:

• B. The fabric wireless controller manages wireless-specific functions like authentication and roaming, not endpoint-to-edge bindings.
• C. The fabric border node connects the SD-Access fabric to external networks; it does not manage internal endpoint bindings.
• D. Fabric edge nodes are access points for endpoints but do not manage the centralized binding database.

Correct answer: B

OMP (Overlay Management Protocol) is the control plane protocol used between Cisco SD-WAN routers and vSmart controllers. OMP carries routing information, policy, and control messages across the SD-WAN overlay network, enabling centralized policy distribution and dynamic routing.

Why the other options are wrong:

• A. TCP is a transport layer protocol and is not the dedicated control protocol between routers and controllers in SD-WAN.
• C. UDP is used for data plane encapsulation but not as the primary control plane protocol between routers and vSmart controllers.
• D. BGP is a routing protocol but not the control protocol used between SD-WAN routers and vSmart controllers; OMP serves this function.

Correct answer: B

In a three-tier hierarchical design, the core layer should provide redundant Layer 3 point- to-point links between core devices for predictable, faster convergence. This design pattern ensures that core-to-core communication is highly available and converges quickly in failure scenarios, which is critical for maintaining network stability.

Why the other options are wrong:

• A. QoS prioritization is better implemented at the distribution layer where traffic is first aggregated and classified.
• C. Advanced security features like 802.1X, DHCP snooping, and port security belong at the access layer where end devices connect.
• D. Redundant aggregation and first-hop redundancy protocols like VRRP are distribution layer responsibilities, not core layer functions.

Correct answer: C

virtualized environment that provides traffic isolation and segmentation in the SD-WAN fabric A VPN in Cisco SD-WAN is a virtualized environment that provides traffic isolation and segmentation within the SD-WAN fabric. VPNs create separate logical networks allowing different departments, applications, or customers to have isolated routing and forwarding instances while sharing the same physical SD-WAN infrastructure.

Why the other options are wrong:

• A. A common exchange point between services is not the definition of a VPN in SD- WAN context.
• B. An attribute to identify services in specific places describes a service definition or location attribute, not a VPN.
• D. A virtual channel for control plane information describes an overlay tunnel mechanism, not the functional definition of a VPN.

Correct answer: A

A fabric edge node is the entry point for endpoints into the SD-Access fabric. It connects wired and wireless endpoints to the fabric and is responsible for forwarding their traffic into the fabric overlay. Edge nodes perform LISP encapsulation but that is not their primary defining function-their primary role is endpoint connectivity and traffic forwarding.

Why the other options are wrong:

• B. While edge nodes do participate in LISP encapsulation, this is a mechanism they use rather than their defining function.
• C. Connecting the fabric to external networks is the role of a border node, not an edge node.
• D. Providing underlay reachability between border nodes is an underlay function, not an edge node responsibility.

Correct answer: C

The fusion router in SD-Access performs route leaking between user-defined virtual networks (VNs) and shared services. This allows traffic from user VNs to reach shared service resources while maintaining network segmentation. The fusion router bridges the overlay VN policies with external routing domains and shared service access.

Why the other options are wrong:

• A. DNS services are not provided by fusion routers in SD-Access.
• B. Additional forwarding capacity is not the primary role; border nodes handle fabric-to- external connectivity.
• D. While fusion routers do connect to external networks, their specific role is route leaking between VNs and shared services.

Correct answer: C

The vSmart controller is responsible for distributing security information and policies needed for secure tunnel establishment between vEdge routers. It provides the control plane intelligence for the SD-WAN fabric, determining which tunnels should be established and what security parameters they should use.

Why the other options are wrong:

• A. Onboarding of vEdge nodes is handled by the vBond orchestrator.
• B. Telemetry data gathering is a function of vManage, the management plane.
• D. Configuration and status management is handled by vManage, not vSmart.

Correct answer: A

In Cisco SD-Access wireless deployments, the access point is considered part of the fabric overlay. The AP connects to the wireless LAN controller (WLC), which is integrated into the fabric, and the AP itself becomes part of the overlay fabric architecture, enabling the same segmentation and policy capabilities as wired fabric edge nodes.

Why the other options are wrong:

• B. The wireless client (endpoint) is not part of the fabric overlay; it connects through the AP.
• C. The AP is part of the overlay, not the underlay.
• D. The WLC is part of the overlay as a control and management component, not the underlay.

Correct answer: B

A fabric edge node serves as the connection point for wired endpoints to the SD-Access fabric. It is where endpoints attach to the fabric and is responsible for tagging traffic with VLAN information and forwarding it into the LISP overlay. This is the primary role of edge nodes in the fabric architecture.

Why the other options are wrong:

• A. Connecting external Layer 3 networks is the role of border nodes, not edge nodes.
• C. Advertising fabric IP address space is not a primary function of edge nodes.
• D. Edge nodes connect endpoints to the fabric; the fusion router role is different and involves connecting to external networks and shared services.

Correct answer: D

The MAC address table is stored in CAM (Content Addressable Memory), which performs exact-match lookups for Layer 2 forwarding decisions. TCAM (Ternary CAM) is used for features requiring pattern matching with masks, such as ACL and QoS policies. While both are specialized memory types, TCAM extends CAM's capabilities to support more complex matching patterns beyond simple exact matches.

Why the other options are wrong:

• A. This is reversed; TCAM is used for ACL/QoS pattern matching, not L2 forwarding; CAM is used for exact-match L2 lookups.
• B. This is also reversed; router prefix lookups use TCAM, and MAC address lookups use CAM (the reference states CAM, not the reverse).
• C. This is backward; the MAC address table requires exact matches, while TCAM supports partial matches with masks.

Correct answer: C

The vManage controller is the single management plane for Cisco SD-WAN. It provides centralized management, configuration, monitoring, and analytics for all SD-WAN devices. While vSmart provides control plane functions and vBond provides orchestration, vManage is the unified management interface for the entire SD-WAN fabric.

Why the other options are wrong:

• A. vBond is the orchestrator that helps bootstrap devices, not the management plane.
• B. vSmart is the control plane controller that distributes policies, not the management plane.
• D. vEdge is a forwarding node, not a controller.

Correct answer: D

Routed access design facilitates migration to intent-based networking and programmable fabric design. In a routed access topology, every access switch connects via Layer 3 to the distribution layer, eliminating spanning tree complexity and enabling the device-level programmability and policy-based forwarding required by intent-based networking. This architecture provides the foundation needed to transition from traditional campus designs to modern fabric-based architectures.

Why the other options are wrong:

• A. Two-tier design collapses access and distribution layers but doesn't specifically enable the programmable fabric transition as effectively as routed access.
• B. Layer 2 access relies on spanning tree and lacks the Layer 3 programmability needed for fabric designs.
• C. Three-tier design adds unnecessary complexity and doesn't align with the flattened, programmable nature of modern fabric designs.

Correct answer: A

Fabric access points operate in local mode and must connect directly to fabric edge switches. In local mode, the AP processes traffic locally rather than tunneling it to a controller. The fabric edge switch provides the connection point to the fabric infrastructure, where traffic is then distributed appropriately within the fabric network.

Why the other options are wrong:

• B. While local mode is correct, fabric APs connect to edge switches, not border nodes; border nodes handle external network connectivity.
• C. Fabric APs do not operate in FlexConnect mode; FlexConnect is used for standalone or cloud-based deployments outside the fabric.
• D. FlexConnect mode is incorrect for fabric APs, and even if local mode were used, the connection point is the edge switch, not the border node.

Correct answer: B

VRRP version 3 is the only protocol that meets all three requirements. VRRP v3 supports multivendor environments (it's a standards-based protocol), provides FHRP redundancy, and crucially supports both IPv4 and IPv6. VRRP v2 only supports IPv4. HSRP and GLBP are Cisco-proprietary, failing the multivendor requirement.

Why the other options are wrong:

• A. VRRP version 2 only supports IPv4 and cannot meet the IPv6 requirement.
• C. GLBP is a Cisco-proprietary protocol that cannot be used in a multivendor router environment.
• D. HSRP version 2 is a Cisco-proprietary protocol incompatible with non-Cisco routers in a multivendor environment.

Correct answer: B

The error message indicates that the active router on group 1 has a virtual IP of 10.1.1.1, but the local router is configured with 10.1.1.25. For HSRP to function properly, all routers in the same group must be configured with the same virtual IP address. The local router's virtual address must be changed from 10.1.1.25 to 10.1.1.1 to match the group configuration.

Why the other options are wrong:

• A. The group configuration is already correct (group 1); the problem is the IP address mismatch, not the group number.
• C. The remote router is already configured correctly with 10.1.1.1; the local router is the one that needs fixing.
• D. The remote router's group configuration is correct; changing it would break the HSRP setup.

Correct answer: C

VRRP (Virtual Router Redundancy Protocol) should be configured on the interfaces that directly serve as the default gateway for PC-01 and PC-02. Looking at the topology, PC-01 and PC-02 connect to ASW-01 via G0/10 and G0/20 respectively, and ASW-01 connects upward to the network through its G0/0 and G0/1 interfaces toward Edge-01 and Edge-02. The first hop redundancy for these PCs must be provided by the edge routers' interfaces that connect to ASW-01, which are G0/1 on Edge-01 and G0/1 on Edge-02. These interfaces should run VRRP to provide a virtual gateway address that the PCs can use, ensuring high availability if one edge router fails.

Why the other options are wrong:

• A. The Core router's interfaces are too far upstream and don't provide direct first hop redundancy for PC-01 and PC-02.
• B. G0/0 interfaces on the edge routers connect to the Core, not to ASW-01 where the PCs' traffic originates.
• D. ASW-01 is an access switch, not a router, and cannot run VRRP; redundancy must be provided by the upstream routers (Edge-01 and Edge-02).

Correct answer: B

An outbound QoS policy on a WAN interface is most beneficial under interface saturation conditions. When the WAN interface becomes congested and cannot accommodate all offered traffic, QoS policies control congestion through traffic classification, marking, and queuing, preventing dropped packets and maintaining service quality. Under normal conditions with available bandwidth, QoS provides minimal benefit.

Why the other options are wrong:

• A. Traffic classification and marking are mechanisms used by QoS, not conditions under which it is most beneficial; QoS provides the greatest benefit when those markings are acted upon during congestion.
• C. QoS policies are most beneficial under specific conditions (saturation), not under all network conditions when bandwidth is available.
• D. During network convergence, QoS has minimal impact; saturation conditions are when QoS policies provide the most value.

Correct answer: A

To ensure this router becomes active, it must have a priority higher than the default (100) and preemption enabled. Option A specifies HSRP version 2, a priority of 110 (higher than default), and preempt to immediately take over if it becomes functional. The version 2 specification is important for modern deployments. The timers in option B are incorrect syntax, option C uses priority 90 (lower than default), and option D lacks the version specification.

Why the other options are wrong:

• B. The timers parameter syntax is incorrect; this command structure does not properly configure HSRP priority and preemption.
• C. A priority of 90 is lower than the default 100, so this router would become standby, not active.
• D. While this sets preemption and a higher priority, it lacks the version 2 specification which is a best practice for modern configurations.

Correct answer: B

A fabric border node serves as the gateway between the Cisco SD-Access fabric and external networks, including other fabric instances and traditional Layer 3 networks. It handles the translation and routing of traffic between the fabric's VXLAN overlay and non- fabric networks, enabling secure and controlled inter-fabric and fabric-to-external connectivity.

Why the other options are wrong:

• A. Collecting traffic flow information is a function of network analytics and telemetry systems, not specifically the border node.
• C. Attaching and registering clients to the fabric is the function of fabric edge switches, not border nodes.
• D. Handling IP address and location information for endpoints is a controller or policy server function, not the border node.

Correct answer: D

Fast roam is the roaming method used in Cisco SD-Access when a client moves from one AP to another on a different access switch within a single WLC domain. Fast roam enables seamless mobility by maintaining the client's identity and security context across the transition, allowing quick reassociation without full reauthentication.

Why the other options are wrong:

• A. Layer 3 roaming refers to mobility across different subnets or Layer 3 domains, not the specific case of moving between APs on different access switches within one WLC.
• B. Inter-xTR roaming is related to Cisco SD-Access fabric extensions but is not the primary roaming method for intra-WLC mobility.
• C. Auto anchor is a LISP-related concept for managing mobility but is not the specific roaming method terminology used for AP-to-AP transitions within a single WLC.

Correct answer: C

The recommended MTU size for a Cisco SD-Access Fabric is 9100 bytes. This jumbo frame size accommodates the overhead introduced by fabric encapsulation (LISP and other headers) while maximizing throughput and minimizing fragmentation across the fabric infrastructure.

Why the other options are wrong:

• A. 4464 bytes is not the standard recommended MTU for SD-Access fabric deployments.
• B. 17914 bytes exceeds practical MTU limits and is not a standard recommendation for SD-Access.
• D. 1500 bytes is the standard Ethernet MTU but is too small for SD-Access fabric operations due to encapsulation overhead.

Correct answer: C

The fabric control plane node holds a comprehensive database that tracks endpoints and networks within the fabric. This node maintains endpoint location information, network mappings, and other control plane intelligence necessary for fabric operation and policy enforcement.

Why the other options are wrong:

• A. Policy application and network segmentation are functions of the policy plane, not exclusively the control plane node.
• B. Traffic encapsulation and security profile enforcement are primarily data plane functions, not control plane responsibilities.
• D. Integration with legacy nonfabric-enabled environments is handled by edge nodes and border nodes, not the control plane node itself.

Correct answer: B

Data policy in Cisco SD-WAN is a set of statements that defines how data is forwarded based on IP packet information and specific VPNs. It determines packet routing decisions, QoS treatment, and VPN membership based on traffic characteristics.

Why the other options are wrong:

• A. This describes device configuration and authentication policies, not data policies.
• C. This describes address mapping or a routing/forwarding database function, not a data policy.
• D. This describes monitoring and health-check services, not data policy definitions.

Correct answer: D

BFD (Bidirectional Forwarding Detection) is the protocol used in Cisco SD-WAN to measure link quality and detect failures. It provides fast, accurate feedback on the health and viability of SD-WAN transport links.

Why the other options are wrong:

• A. IPsec is an encryption protocol for secure tunneling, not for link quality measurement.
• B. OMP (Overlay Management Protocol) is used for control plane communication and route distribution, not link quality measurement.
• C. RSVP is a resource reservation protocol, not specifically used for SD-WAN link quality measurement.

Correct answer: C

The TOS (Type of Service) field in the Layer 3 header is used to perform QoS packet classification. The TOS field, which includes the DSCP (Differentiated Services Code Point) bits, allows devices to identify and classify packets for differential treatment based on quality of service requirements.

Why the other options are wrong:

• A. Layer 2 frame Type fields are used for protocol identification, not QoS classification.
• B. The Options field in Layer 3 headers is for miscellaneous IP options, not standard QoS classification.
• D. The Flags field in Layer 3 headers is used for fragmentation control, not QoS classification.

Correct answer: C

Cloud deployments have lower upfront costs than on- premises deployments. Cloud deployments have lower upfront costs than on-premises deployments because they eliminate the need for large capital expenditures on hardware, infrastructure, and facilities. Cloud providers handle infrastructure investment, and customers pay operational expenses instead.

Why the other options are wrong:

• A. Cloud deployments typically enable faster implementation times due to reduced infrastructure setup requirements.
• B. On-premises deployments are generally more customizable than cloud deployments, allowing direct hardware and software control.
• D. Cloud deployments often require more frequent updates and upgrades managed by the provider, not fewer.

Correct answer: A

The vBond controller is capable of acting as a STUN server during the onboarding process of Edge devices. vBond facilitates NAT traversal and provides connectivity assistance for new Edge devices joining the SD-WAN overlay network.

Why the other options are wrong:

• B. vSmart is the control plane orchestrator responsible for policy and route distribution, not STUN server functions.
• C. vManage is the management and visualization platform, not involved in STUN server operations.
• D. PNP Server is a separate service for plug-and-play onboarding but is not the SD- WAN controller that acts as STUN.

Correct answer: B

In a fabric-enabled SSID, access points convert 802.11 wireless traffic into 802.3 Ethernet frames at the AP itself. This converted traffic is then encapsulated into VXLAN tunnels for transport to the WLC. This approach reduces latency and offloads processing from the WLC by enabling local switching of traffic while maintaining centralized policy control.

Why the other options are wrong:

• A. While traffic may be mapped to VXLAN, it is not done centrally on the WLC; the AP handles the conversion and encapsulation.
• C. Traffic is not mapped to a traditional VLAN on the WLC; fabric-enabled SSIDs use VXLAN encapsulation.
• D. Although the AP converts to 802.3, the encapsulation is into VXLAN, not a standard VLAN.

Correct answer: C

In HSRP (Hot Standby Router Protocol), the router with the highest priority becomes the active router, and the one with the lower priority becomes the standby. R1 has a priority of 255 (configured 255) while R2 has a priority of 200 (configured 200). Since both routers show 'Standby router is unknown,' they cannot establish the active/standby relationship properly. The priority values need to match in the sense that they should be configured differently to establish a clear master-backup relationship, but more importantly, both routers are not recognizing each other as valid HSRP peers. R1 with priority 255 should be active and R2 with priority 200 should be standby, but the configuration shows both are 'Active router is local' and 'Standby router is unknown,' indicating a mismatch in their HSRP group configuration. Configuring matching priority values alone won't help, but examining the output shows the real issue is that they have different virtual IP addresses (192.168.0.1 vs 192.168.1.1) and different preemption settings, but the primary reason they cannot form a proper redundant pair is that their priorities are misaligned for proper active/standby designation.

Why the other options are wrong:

• A. The timers are already different (Hello 5/10 sec, Hold 15/30 sec) but this is acceptable in HSRP; timers do not need to match exactly for HSRP to function properly.
• B. Both routers already have matching key-strings ('cisco123'), so the authentication is consistent.
• D. Having unique virtual IP addresses is the actual problem-they should have the same virtual IP address (both 192.168.0.1 or both 192.168.1.1) to function as a redundant pair, not different ones.

Correct answer: B

When Router1 fails and Router2 becomes the primary, Router1 will not automatically reclaim the forwarding role upon recovery unless preemption is enabled. The 'standby preempt' command allows a router to take over the active role when it returns to service if it has a higher priority than the current active router. Since Router1 has priority 110 (higher than Router2's default priority of 100), enabling preemption will cause Router1 to reclaim the primary role when it recovers.

Why the other options are wrong:

• A. The 'standby priority' command sets the priority value but does not enable the mechanism to actually take over when the router returns to service.
• C. The 'standby track' command monitors specific interfaces or objects to adjust priority dynamically, not to force takeover upon recovery.
• D. The 'standby timers' command adjusts hello and hold intervals for HSRP convergence timing, not the behavior of reclaiming primary status after recovery.

Correct answer: A

DHCP option 43 for Cisco APs requires hexadecimal formatting with a specific structure. The format is F1 (tag) followed by 04 (length in bytes) and the IP address in hexadecimal. The IP 172.16.50.5 converts to AC.10.32.05 in hex, making the correct option 43 value F104.AC10.3205. ASCII format cannot be used for this purpose as it is not properly encoded for AP discovery.

Why the other options are wrong:

• B. The hexadecimal conversion is incorrect; CA10 does not represent 172.16.
• C. DNS server configuration is not the appropriate method for DHCP option 43 AP discovery.
• D. Configuring the default router as DNS does not provide the WLC discovery mechanism needed.

Correct answer: B

vSmart is the control plane component in Cisco SD-WAN that is responsible for monitoring, configuring, and maintaining all SD-WAN devices in the network. It collects information from vManage (management plane) and pushes configuration and policies to vEdges and other SD-WAN devices, orchestrating the overall network behavior and policy enforcement.

Why the other options are wrong:

• A. vSmart does not directly establish secure control plane connections; this is handled by the control plane protocol itself.
• C. Secure data plane connectivity is provided by the data plane components and encryption between vEdges, not vSmart.
• D. Initial device authentication is performed by vBond orchestrator, not vSmart.

Correct answer: C

Link Management Protocol (LMP) in a StackWise Virtual domain performs the critical function of detecting and rejecting unidirectional link traffic. This prevents data plane issues that could arise from asymmetric or one-way links between stack members, ensuring bidirectional connectivity is maintained for proper stack operation and data forwarding.

Why the other options are wrong:

• A. Active/standby determination is handled by the Stackwise Virtual protocol election mechanism, not LMP.
• B. Hardware compatibility checking occurs during the initial stack formation, not through LMP.
• D. SVL interface discovery and bring-up is handled by the StackWise Virtual protocol, not specifically by LMP.

Correct answer: A

The ETR (Egress Tunnel Router) is responsible for publishing EID-to-RLOC mappings for a site to the mapping system. ETRs are located at the edge of a LISP site and send mapping registrations to the Map Server, making the site's EID-to-RLOC associations available throughout the LISP infrastructure.

Why the other options are wrong:

• B. The Map Resolver (MR) requests mappings and resolves EID-to-RLOC information; it does not publish mappings.
• C. The ITR (Ingress Tunnel Router) encapsulates packets for LISP routing but does not publish site mappings.
• D. The Map Server (MS) receives and stores mappings from ETRs but does not perform the publishing function itself.

Correct answer: A

In an MPLS VPN topology, a CE (Customer Edge) router connects to a PE (Provider Edge) router. R1 is identified as a CE router that connects to R2 (a PE router) via the G0/0-G0/0 link. CE routers operate in the default VRF and do not have customer-specific VRFs assigned to their interfaces. The VRFs (VPN_A and VPN_B) are configured on the PE router (R2), not on the CE router (R1). R1's interface G0/0 uses the default VRF for communication with the PE, while the PE router internally separates traffic into different VRFs for each customer.

Why the other options are wrong:

• B. VRF VPN_A is assigned to interfaces on the PE router (R2) in VPN_A, not on the CE router R1.
• C. VRF VPN_B is assigned to interfaces on the PE router (R2) in VPN_B, not on the CE router R1.
• D. Management VRF is a separate out-of-band management interface configuration, not applicable to regular data plane interfaces on CE routers.