Practice Free 350-401 Implementing Cisco Enterprise Network Core Technologies (350-401 ENCOR) v1.2 Exam Questions Answers With Explanation

The correct answer is D. NTP trusted-key 1.

ntp authenticate

ntp authentication-key 1 md5 NTP-p455w0rd

To fully enable NTP authentication, three components are required:

Enable authentication globally

ntp authenticate

Define the authentication key

ntp authentication-key < key-id > md5 < password >

Trust the key

ntp trusted-key < key-id >

The configuration already defines key 1

The missing step is to mark this key as trusted

Without ntp trusted-key 1 , the router will not use the key, even if it is defined

A. NTP server 10.1.1.1 key NTP-p455w0rd Incorrect syntax. The key must be referenced by key ID (number), not password.

B. NTP trusted-key NTP-p455w0rd Incorrect. Trusted-key uses the key ID, not the password.

C. NTP server 10.1.1.1 key 1 This command is used on a client, not required to complete authentication on the server itself in this context.

For NTP authentication, always remember:

authenticate ? authentication-key ? trusted-key

If any of these three are missing, authentication will not work properly.

The inside user subnet is 192.168.1.0/24, which supports 254 usable host addresses. The configured NAT pool only provides addresses from 10.10.10.1 through 10.10.10.100, giving 100 usable translated addresses. Dynamic NAT without overload requires a sufficient number of inside global addresses if all users must be translated at the same time. Therefore, to support all users continuously, the NAT pool must be increased to support the 254 usable inside hosts. Option C is the best answer. Option A, match-host, is not the correct fix for the pool-size shortage; it is used for host-number matching behavior and still requires a usable pool design. Option B is wrong because NAT should translate private inside addresses to a different inside global address range, not reuse the same inside local subnet. Option D describes static one-to-one behavior and does not match the dynamic NAT route-map configuration shown. The key technical issue is address pool capacity. References/topics: ENCOR Infrastructure, NAT, dynamic NAT, inside local and inside global addresses, NAT pools, route-map-based NAT.

Solution:

Copy run start

Verification:

OR

The correct answer is D.

Cisco campus design guidance explains that a nonlooped topology with unique VLANs per access switch improves stability and convergence compared with looped Layer 2 designs. Cisco states that in a multilayer campus design, each access switch should have unique VLANs, with no Layer 2 loops and no blocked links, which improves convergence behavior. Cisco also notes that VLANs spanning multiple access switches increase flooding impact, while a nonlooped topology with localized VLANs reduces that impact.

A traditional nonlooped design reduces reliance on spanning-tree reconvergence across shared Layer 2 domains. With unique/local VLANs, failures affect a smaller fault domain and convergence is faster than in a looped design with common VLANs stretched across switches. Cisco’s campus design material specifically recommends no Layer 2 loops and unique VLANs per access switch for better operational behavior.

A. Traditional looped design that has common VLANs extended between separate access switches This increases Layer 2 complexity and spanning-tree dependency, which slows convergence compared to a nonlooped design. Cisco documents that VLANs spanning multiple access switches increase flooding impact.

B. Cisco SD-Access configuration between aggregation intermediate nodes and access layers This is not the standard way the question is framed for classic aggregation-to-Layer 2 access convergence in a traditional enterprise campus design. The question is targeting the design principle of looped vs nonlooped Layer 2 access.

C. Cisco SD-Access configuration between aggregation and access-layer edge nodes SD-Access is a different fabric architecture. The question is about reducing convergence time between aggregation and a Layer 2 access layer, which maps to the traditional campus design choice rather than SD-Access node roles.

For enterprise campus design, remember:

Looped Layer 2 + stretched/common VLANs = slower convergence and larger fault domains

Nonlooped Layer 2 + unique/local VLANs per access switch = faster convergence and better stability

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get http://10.10.1.100

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution: -

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

Copy run start

Verification:

OR

Solution:

VERIFICATION: -

OR

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R2

R3

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:-

Copy run start

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http gethttp://10.10.1.100

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr