CCNP ENCOR 350-401 NEWEST 2025 EXAM
QUESTIONS AND CORRECT ANSWERS | A+ GRADE
An engineer must block all traffic from a router to its directly connected subnet
209.165.200.0/24. The engineer applies access control list EGRESS in the
outbound direction on the GigabitEthernet0/0 interface of the router. However,
the router can still ping hosts on the 209.165.200.0/24 subnet. Which explanation
of this behavior is true?
A. Access control lists that are applied outbound to a router interface do not
affect traffic that is sourced from the router.
B. After an access control list is applied to an interface, that interface must be
shut and no shut for the access control list to take effect.
C. Only standard access control lists can block traffic from a source IP address.
D. The access control list must contain an explicit deny to block traffic from the
router - ans -A
Which two methods are used by an AP that is trying to discover a wireless LAN
controller? (Choose two.)
A. Cisco Discovery Protocol neighbor
B. querying other APs
C. DHCP Option 43
D. broadcasting on the local subnet
E. DNS lookup CISCO-DNA-PRIMARY.localdomain - ans -CD
Which IP SLA operation requires the IP SLA responder to be configured on the
remote end?
,A. UDP jitter
B. ICMP jitter
C. TCP connect
D. ICMP echo - ans -A
Which statement explains why Type 1 hypervisor is considered more efficient
than Type2 hypervisor?
A. Type 1 hypervisor is the only type of hypervisor that supports hardware
acceleration techniques.
B. Type 1 hypervisor relies on the existing OS of the host machine to access CPU,
memory, storage, and network resources.
C. Type 1 hypervisor runs directly on the physical hardware of the host machine
without relying on the underlying OS.
D. Type 1 hypervisor enables other operating systems to run on it. - ans -C
A client with IP address 209.165.201.25 must access a web server on port 80 at
209.165.200.225. To allow this traffic, an engineer must add a statement to an
access control list that is applied in the inbound direction on the port connecting
to the web servers. Which statement allows this traffic?
A. permit tcp host 209.165.200.225 lt 80 host 209.165.201.25
B. permit tcp host 209.165.201.25 host 209.165.200.225 eq 80
C. permit tcp host 209.165.200.225 eq 80 host 209.165.201.25
D. permit tcp host 209.165.200.225 host 209.165.201.25 eq 80 - ans -B
In OSPF, which LSA type is responsible for pointing to the ASBR router?
type 1
type 2
C. type 3
D. type 4 - ans -D
VLANs 50 and 60 exist on the trunk links between all switches. All access ports on
SW3 are configured for VLAN 50 and SW1 is the VTP server. Which command
ensures that SW3 receives frames only from VLAN 50?
, SW1(config)#vtp mode transparent
SW3(config)#vtp mode transparent
C. SW2(config)#vtp pruning
D. SW1(config)#vtp pruning - ans -D
Which statement about a fabric access point is true?
It is in local mode and must be connected directly to the fabric edge switch.
It is in local mode and must be connected directly to the fabric border node
C. It is in FlexConnect mode and must be connected directly to the fabric border
node.
D. It is in FlexConnect mode and must be connected directly to the fabric edge
switch. - ans -A
Which First Hop Redundancy Protocol maximizes uplink utilization and minimizes
the amount of configuration that is necessary?
A. GLBP
B. HSRP v2
C. VRRP
D. HSRP v1 - ans -A
Which function does a fabric edge node perform in an SD-Access deployment?
A. Connects endpoints to the fabric and forwards their traffic.
B. Encapsulates end-user data traffic into LISP.
C. Connects the SD-Access fabric to another fabric or external Layer 3 networks.
D. Provides reachability between border nodes in the fabric underlay. - ans -A
Which privilege level is assigned to VTY users?
A. 1
B. 7
C. 13
D. 15 - ans -A
What is the difference between a RIB and a FIB?
A. The FIB is populated based on RIB content.
B. The RIB maintains a minor image of the FIB.
C. The RIB is used to make IP source prefix-based switching decisions.
D. The FIB is where all IP routing information is stored - ans -A
QUESTIONS AND CORRECT ANSWERS | A+ GRADE
An engineer must block all traffic from a router to its directly connected subnet
209.165.200.0/24. The engineer applies access control list EGRESS in the
outbound direction on the GigabitEthernet0/0 interface of the router. However,
the router can still ping hosts on the 209.165.200.0/24 subnet. Which explanation
of this behavior is true?
A. Access control lists that are applied outbound to a router interface do not
affect traffic that is sourced from the router.
B. After an access control list is applied to an interface, that interface must be
shut and no shut for the access control list to take effect.
C. Only standard access control lists can block traffic from a source IP address.
D. The access control list must contain an explicit deny to block traffic from the
router - ans -A
Which two methods are used by an AP that is trying to discover a wireless LAN
controller? (Choose two.)
A. Cisco Discovery Protocol neighbor
B. querying other APs
C. DHCP Option 43
D. broadcasting on the local subnet
E. DNS lookup CISCO-DNA-PRIMARY.localdomain - ans -CD
Which IP SLA operation requires the IP SLA responder to be configured on the
remote end?
,A. UDP jitter
B. ICMP jitter
C. TCP connect
D. ICMP echo - ans -A
Which statement explains why Type 1 hypervisor is considered more efficient
than Type2 hypervisor?
A. Type 1 hypervisor is the only type of hypervisor that supports hardware
acceleration techniques.
B. Type 1 hypervisor relies on the existing OS of the host machine to access CPU,
memory, storage, and network resources.
C. Type 1 hypervisor runs directly on the physical hardware of the host machine
without relying on the underlying OS.
D. Type 1 hypervisor enables other operating systems to run on it. - ans -C
A client with IP address 209.165.201.25 must access a web server on port 80 at
209.165.200.225. To allow this traffic, an engineer must add a statement to an
access control list that is applied in the inbound direction on the port connecting
to the web servers. Which statement allows this traffic?
A. permit tcp host 209.165.200.225 lt 80 host 209.165.201.25
B. permit tcp host 209.165.201.25 host 209.165.200.225 eq 80
C. permit tcp host 209.165.200.225 eq 80 host 209.165.201.25
D. permit tcp host 209.165.200.225 host 209.165.201.25 eq 80 - ans -B
In OSPF, which LSA type is responsible for pointing to the ASBR router?
type 1
type 2
C. type 3
D. type 4 - ans -D
VLANs 50 and 60 exist on the trunk links between all switches. All access ports on
SW3 are configured for VLAN 50 and SW1 is the VTP server. Which command
ensures that SW3 receives frames only from VLAN 50?
, SW1(config)#vtp mode transparent
SW3(config)#vtp mode transparent
C. SW2(config)#vtp pruning
D. SW1(config)#vtp pruning - ans -D
Which statement about a fabric access point is true?
It is in local mode and must be connected directly to the fabric edge switch.
It is in local mode and must be connected directly to the fabric border node
C. It is in FlexConnect mode and must be connected directly to the fabric border
node.
D. It is in FlexConnect mode and must be connected directly to the fabric edge
switch. - ans -A
Which First Hop Redundancy Protocol maximizes uplink utilization and minimizes
the amount of configuration that is necessary?
A. GLBP
B. HSRP v2
C. VRRP
D. HSRP v1 - ans -A
Which function does a fabric edge node perform in an SD-Access deployment?
A. Connects endpoints to the fabric and forwards their traffic.
B. Encapsulates end-user data traffic into LISP.
C. Connects the SD-Access fabric to another fabric or external Layer 3 networks.
D. Provides reachability between border nodes in the fabric underlay. - ans -A
Which privilege level is assigned to VTY users?
A. 1
B. 7
C. 13
D. 15 - ans -A
What is the difference between a RIB and a FIB?
A. The FIB is populated based on RIB content.
B. The RIB maintains a minor image of the FIB.
C. The RIB is used to make IP source prefix-based switching decisions.
D. The FIB is where all IP routing information is stored - ans -A
