Implementing Cisco Enterprise Network Core Technologies (ENCOR) practice questions

Question 1

An architect is evaluating EIGRP for a regional WAN and must select the TWO path attributes that, by default (K1=1, K3=1), make up the EIGRP composite metric. Per the Cisco EIGRP comparison, which TWO are correct?

Accepted Answer

The minimum bandwidth found along the end-to-end path is a default component of the composite metric.

Accepted Answer

The cumulative delay summed along the end-to-end path is a default component of the composite metric.

Answer

The interface load measured on each individual hop is a default weighted component of the composite metric.

Answer

The link reliability measured on each individual hop is a default weighted component of the composite metric.

Question 2

A campus access team is rolling out 802.1X and must explain to operations how a switch can authenticate clients using EAP methods it does not implement locally. Which TWO statements correctly describe the EAP pass-through model?

Accepted Answer

Acting as a pass-through agent, the switch relays EAP messages to a backend server without understanding methods

Accepted Answer

EAP can support multiple authentication mechanisms without the peer and server pre-negotiating a particular one

Answer

Before authentication finishes, the authenticator forwards every Layer 2 frame except EAPOL onto the data VLAN

Answer

The authenticator must locally implement EAP-TLS, PEAP, and EAP-FAST to validate each supplicant's credentials

Question 3

An enterprise network architect is designing an SD-WAN overlay for 250 branch sites and must explain to the steering committee which Cisco component owns the centralized management dashboard and exposes REST APIs for configuration, monitoring, and troubleshooting. Per the Cisco SD-WAN documentation, which option matches?

Accepted Answer

vManage is the centralized management dashboard providing configuration, monitoring, and troubleshooting through a GUI and REST APIs for the Cisco Catalyst SD-WAN architecture.

Answer

vBond Orchestrator is the centralized management dashboard providing configuration, monitoring, and troubleshooting through a GUI and REST APIs.

Answer

vSmart Controller is the centralized management dashboard providing configuration, monitoring, and troubleshooting through a GUI and REST APIs and replaces vManage entirely.

Answer

WAN Edge routers operate as the centralized management dashboard, exposing REST APIs to administrators while simultaneously serving as the data plane device that builds IPsec tunnels.

Question 4

A NOC engineer is being tasked with writing an EEM applet to react to a syslog event and must understand the applet structure. Per the Cisco EEM documentation, which option matches?

Accepted Answer

EEM applets are configured directly in the CLI and consist of event detectors (triggers) and action statements (responses).

Answer

EEM applets are configured only through a separate Python script that compiles to a TCL bytecode.

Answer

EEM applets are configured only via NETCONF candidate-datastore commits and consist of a single SNMP-only event trigger.

Answer

EEM applets are configured only via Ansible playbooks on an external orchestrator and consist of a single Ansible task list.

Question 5

An automation engineer is being tasked with describing AI-driven workflows in Cisco Catalyst Center to the leadership team. Per the Cisco Catalyst Center documentation, which option matches?

Accepted Answer

AI-driven workflows include anomaly detection that identifies unusual patterns in network behavior, predictive analysis that forecasts potential issues before they impact users, automated root cause analysis that correlates multiple symptoms to identify underlying problems, and guided remediation that suggests or automates corrective actions.

Answer

AI-driven workflows include only manual log review by a NOC analyst, daily SNMP polls of MIB-II counters, weekly IPSec rekey reports, and static topology diagrams refreshed every quarter by the operations team in the enterprise campus distribution layer of the network design.

Answer

AI-driven workflows include only static IP SLA threshold monitoring, manual NetFlow cache export to a CSV file, manual review of syslog severity-7 debug messages, and a fixed monthly capacity-planning meeting in the data center distribution layer of the enterprise WAN today.

Answer

AI-driven workflows include only manual NETCONF candidate-datastore commits, manual RESTCONF GET requests against device YANG models, manual EEM applet writes to NVRAM, and manual TFTP-based backups of the running configuration on every router in the enterprise WAN.

Question 6

A network engineer is migrating legacy crypto-map IPsec tunnels and needs a routable tunnel interface that supports dynamic routing protocols without applying any crypto maps. Per the Cisco tunnel documentation, which approach matches the requirement?

Accepted Answer

Use a Virtual Tunnel Interface (VTI) with tunnel mode ipsec ipv4 for dynamic routing without crypto maps.

Answer

Configure DMVPN with mGRE plus NHRP so that spoke-to-spoke tunnels form on demand across the hub-and-spoke mesh.

Answer

Apply a crypto map directly onto the physical interface so ESP encrypts transit traffic with no tunnel interface.

Answer

Define a separate VRF for each remote site so every tunnel uses an isolated table with overlapping address space.

Question 7

A senior network architect is being deployed to a regional WAN where the engineer is rolling out a refresh and must contrast EIGRP and OSPF behavior on Cisco IOS. Per the Cisco EIGRP/OSPF comparison documentation, which TWO options match?

Accepted Answer

EIGRP supports unequal-cost load balancing while OSPF only supports equal-cost (ECMP) for traffic across multiple paths in the enterprise WAN edge layer of the network.

Accepted Answer

EIGRP sends partial updates only to affected neighbors while OSPF floods LSAs within areas for topology changes on the enterprise WAN edge routers in production deployments today.

Answer

EIGRP supports only equal-cost load balancing while OSPF supports unequal-cost across multiple paths in the enterprise WAN edge layer of the network in any production deployment.

Answer

EIGRP floods full topology updates to all neighbors every 30 seconds while OSPF sends partial updates for topology changes on the enterprise WAN edge routers.

Question 8

An engineer is being tasked with comparing RADIUS to TACACS+ for wireless 802.1X authentication. Per the Cisco AAA documentation, which option matches?

Accepted Answer

RADIUS (UDP ports 1812/1813) combines authentication and authorization, encrypts only the password, and is better suited for network access control (802.1X, wireless, VPN).

Answer

RADIUS (TCP port 49) separates authentication and authorization, encrypts the entire packet body, and is better suited for network access control (802.1X, wireless.

Answer

RADIUS (UDP port 162) combines authentication and accounting only, never encrypts any field including the password, and is better suited for network access control (802.1X.

Answer

RADIUS (UDP port 67) combines DHCP relay and accounting only, encrypts the entire packet body, and is better suited for network access control (802.1X, wireless.

Question 9

A platform team is rolling out sub-second failure detection for its OSPF and BGP adjacencies across a campus core and must choose the lightweight Hello-based protocol that runs over each path and declares it down when packets stop arriving. Which option matches?

Accepted Answer

BFD, a simple Hello protocol that flags a path down when its periodic packets stop arriving

Answer

EtherChannel, which bundles links into one logical interface for redundancy and load sharing

Answer

Graceful Restart, which keeps routing adjacencies up while a standby supervisor takes over

Answer

Stateful Switchover, which lets a standby supervisor assume forwarding without dropping flows

Question 10

A platform team is rolling out a read-only monitoring client that uses RESTCONF GET to poll operational state from IOS-XE devices, and one service account is intentionally denied read access to a sensitive data resource. According to the RESTCONF specification, what does the server return when that account requests the protected resource?

Accepted Answer

It returns an error response carrying a 401 Unauthorized status line and an access-denied error-tag, and withholds the data resource.

Answer

It returns the requested data resource but quietly strips the sensitive leaf values to blank strings before sending the response body.

Answer

It returns a 200 OK response with an empty data payload so that the client cannot distinguish a denial from an absent resource.

Answer

It returns a 403 Forbidden status line and silently records the attempt without including any structured error-tag in the response.

Question 11

A team is evaluating active performance-measurement options to track two-way latency and jitter between two sites, and must identify which TWAMP entity creates and returns a measurement packet to the sender. Which TWAMP role performs this reflection?

Accepted Answer

The Session-Reflector, which creates and sends a measurement packet when it receives one from the sender.

Answer

The Session-Sender, which originates outbound probe packets but never generates a reply packet of its own.

Answer

The TWAMP-Control channel, which initiates, starts, and stops test sessions instead of reflecting test packets.

Answer

The Server, which negotiates session setup and authentication but delegates all test-packet exchange to others.

Question 12

A data center engineer is designing VTEP placement on the leaf switches of a new VXLAN fabric and must describe what role VTEPs play. Per the Cisco VXLAN documentation, which option matches?

Accepted Answer

VXLAN Tunnel Endpoints (VTEPs) sit at the boundary between the VXLAN overlay and the physical underlay network, performing frame encapsulation (adding VXLAN, UDP, and outer IP headers totaling 50 bytes of overhead) and decapsulation.

Answer

VXLAN Tunnel Endpoints (VTEPs) sit only at the spine layer of a VXLAN fabric, exclusively performing route reflection between leaf devices and never directly encapsulating tenant Ethernet frames with VXLAN headers on the device.

Answer

VXLAN Tunnel Endpoints (VTEPs) sit only at the SD-WAN edge of a campus fabric, exclusively performing IPsec encryption between branch sites and never directly performing VXLAN encapsulation on tenant traffic at all.

Answer

VXLAN Tunnel Endpoints (VTEPs) sit only inside the vManage controller of a Catalyst SD-WAN fabric, exclusively performing policy distribution to branch sites and never directly handling VXLAN frame encapsulation traffic.

Question 13

An enterprise is migrating its time architecture and the engineer must explain to the team how clock accuracy behaves as the NTP stratum number increases away from the reference clock. Per RFC 5905, which statement is correct?

Accepted Answer

Accuracy degrades as the stratum number increases, with mean error rising with stratum and round-trip delay.

Answer

Accuracy stays constant at every stratum because each server re-derives time directly from the primary reference.

Answer

Accuracy improves as the stratum number grows because more intermediate servers average out the timing errors.

Answer

Accuracy is determined only by the local oscillator and is unaffected by the device's position in the hierarchy.

Question 14

A financial-services firm is rolling out hardware-token two-factor login for its RADIUS-backed remote-access VPN, where each user must encrypt an unpredictable number shown at sign-in and return the computed result. Which authentication concept does this token scheme implement?

Accepted Answer

Challenge/response authentication, where the token encrypts an unpredictable number using its secret key

Answer

Accounting that streams each VPN session's start and stop records plus byte counts to the central server

Answer

Per-command authorization that limits which configuration commands the signed-in VPN user is allowed to run

Answer

Pass-through relaying where the access server forwards the EAP exchange to a backend without validating it

Question 15

A campus team is designing a large enterprise headquarters topology and the lead architect must explain the rationale for separating access, distribution, and core layers. Per Cisco enterprise design guidance, which option matches?

Accepted Answer

The three-tier design separates access, distribution, and core layers, providing clear functional boundaries and scalability for large enterprises.

Answer

The three-tier design separates access, distribution, and core layers, providing dynamic NAT translation and PAT overload.

Answer

The three-tier design separates access, distribution, and core layers, providing automatic LISP-based mobility between sites without requiring any underlay routing protocol configuration on the network.

Answer

The three-tier design separates access, distribution, and core layers, providing in-line VXLAN encapsulation.

Implementing Cisco Enterprise Network Core Technologies (ENCOR)

Sample questions

Sources

Similar exams