Free ENCOR Practice Questions

Question 1

Replacing an access switch interrupts VLAN 40: its uplink on the distribution switch enters root-inconsistent. The distribution switch must remain the spanning-tree root, and root guard is enabled on its designated port toward the access switch.

Distribution switch: base bridge priority 24576
Replacement access switch: advertises itself as root with base bridge priority 4096

Both switches use Rapid PVST+. Every other switch has a VLAN 40 base priority of 32768 or higher. How can forwarding be restored without sacrificing the intended root placement or its protection?

Accepted Answer

Set the access switch's VLAN 40 priority to 32768; retain root guard.

Answer

Remove root guard from the distribution port and allow a new root election.

Answer

Raise the distribution port's path cost for VLAN 40.

Answer

Replace root guard with BPDU guard on the distribution-to-access link.

Question 2

The local recovery account on an IOS XE router has privilege 15. During a TACACS+ outage, its password is accepted, but the SSH session closes before an EXEC shell opens.

aaa new-model
aaa authentication login OPS group TAC-GRP local
aaa authorization exec OPS group TAC-GRP
line vty 0 4
 login authentication OPS
 authorization exec OPS
 transport input ssh

All servers in TAC-GRP are unreachable. Policy requires TACACS+ authorization whenever those servers can respond; during an outage, EXEC access must use the local user's authorization attributes. Select the command that corrects the failure and preserves this policy.

Accepted Answer

aaa authorization exec OPS group TAC-GRP local

Answer

aaa authentication login OPS local group TAC-GRP

Answer

aaa authorization exec OPS group TAC-GRP if-authenticated

Answer

aaa authorization exec OPS local group TAC-GRP

Question 3

Voice quality deteriorates during bursts on a branch's provider connection. The Ethernet handoff runs at 1 Gb/s, but the provider accepts only 80 Mb/s and discards excess traffic. The router already gives voice a priority queue and business traffic a bandwidth guarantee; the provider starts dropping packets before these local queues experience sustained congestion.

The router supports hierarchical QoS. Which egress design will buffer short bursts, pace the aggregate to 80 Mb/s, and preserve the existing treatment of each class?

Accepted Answer

Use an 80-Mb/s parent shaper with the existing class-based queuing policy attached beneath it.

Answer

Police the aggregate at 80 Mb/s above the existing queuing policy.

Answer

Change the interface bandwidth setting to 80 Mb/s while retaining the existing flat queuing policy.

Answer

Increase the voice priority reservation to 80% while retaining the existing flat queuing policy.

Question 4

The nightly inventory job should open incidents only for unreachable access switches. Each device supplies reachabilityStatus as either "Reachable" or "Unreachable", and role as either "ACCESS" or "CORE". Yet reachable access switches also generate incidents:

incidents = []
for device in inventory:
    if device["reachabilityStatus"] and device["role"] == "ACCESS":
        incidents.append(device["hostname"])

Replace the if statement so that the job selects exactly the intended devices.

Accepted Answer

if device["reachabilityStatus"] == "Unreachable" and device["role"] == "ACCESS":

Answer

if device["reachabilityStatus"] == "Unreachable" or device["role"] == "ACCESS":

Answer

if not device["reachabilityStatus"] and device["role"] == "ACCESS":

Answer

if device["reachabilityStatus"] == "Unreachable" and device["role"] != "ACCESS":

Question 5

An IP packet for 10.60.10.9 arrives on an interface assigned to VRF BLUE. The router has these routes:

BLUE: 10.60.10.0/24 via 192.0.2.2, OSPF cost 20
RED: 10.60.10.0/24 via 198.51.100.2, OSPF cost 5
Global: 10.60.10.9/32 via 203.0.113.2, static

All next hops are reachable within their respective routing contexts. No route leaking or policy-based routing is configured. Identify the forwarding result and the reason for it.

Accepted Answer

It uses 192.0.2.2 because the ingress interface selects BLUE for the routing lookup.

Answer

It uses 198.51.100.2 because RED has a lower-cost route to the destination subnet.

Answer

It drops the packet because the same destination subnet appears in both BLUE and RED.

Answer

It uses 203.0.113.2 because the global table contains a more-specific route to the host.

Question 6

The monitoring team asks you to investigate an OSPF neighbor that has remained in 2-Way for 30 minutes. Four routers share an Ethernet VLAN using the broadcast network type. R1's interface state is DROTHER, and its neighbor table contains:

Neighbor ID    State
2.2.2.2        FULL/DR
3.3.3.3        FULL/BDR
4.4.4.4        2WAY/DROTHER

R4, whose router ID is 4.4.4.4, is also Full with the same DR and BDR. Area routes are present and traffic is passing. What disposition is appropriate for this alert?

Accepted Answer

Treat the relationship as expected and make the alert account for the routers' roles.

Answer

Clear the OSPF process on R1 to force all three neighbor relationships to reach Full.

Answer

Apply OSPF MTU-ignore on R1 and R4 to move the relationship beyond 2-Way.

Answer

Make R1 and R4 use the same OSPF process number to complete database synchronization.

Question 7

A branch's availability policy keeps its primary WAN route eligible whenever an ICMP echo reply arrives within 1,000 ms. A separate performance objective requires a round-trip time of 100 ms or less. The router is configured as follows:

ip sla 10
 icmp-echo 198.51.100.10 source-interface Loopback0
 threshold 100
 timeout 1000
 frequency 5
ip sla schedule 10 life forever start-time now
track 10 ip sla 10 state

The primary route references track 10. An independent host route keeps the probe on the primary WAN. The latest results are RTT 150 ms, return code OverThreshold, and track 10 Down. No tracking delay is configured. Which adjustment keeps this reachable route eligible while retaining the 100 ms performance objective?

Accepted Answer

Switch track 10 to IP SLA reachability tracking.

Answer

Raise the IP SLA threshold to 200 ms.

Answer

Reduce the IP SLA timeout from 1,000 to 500 milliseconds.

Answer

Reduce the IP SLA frequency from five seconds to one second.

Question 8

Security has requested a narrow change: deny HTTPS from 10.24.8.64/27 to 192.0.2.80 while preserving every other flow currently permitted. This ACL is applied inbound on the routed interface facing the clients:

ip access-list extended WEB-IN
 10 permit tcp 10.24.8.0 0.0.0.255 host 192.0.2.80 eq 443
 20 deny tcp 10.24.8.64 0.0.0.31 host 192.0.2.80 eq 443
 30 permit ip any any

A new HTTPS connection from 10.24.8.70 still succeeds. Which edit implements the requested restriction?

Accepted Answer

Move the existing sequence 20 entry ahead of sequence 10.

Answer

Apply WEB-IN outbound on the same client-facing interface instead.

Answer

Make sequence 20 deny all IP from 10.24.8.64/27.

Answer

Replace sequence 30 with an entry denying all remaining IP traffic.

Question 9

During a phased SD-Access migration, industrial controllers will temporarily be split between traditional campus switches and fabric edge switches. The controllers must retain their IP addresses and exchange Ethernet frames in the same subnet; routing between separate segments cannot satisfy the application.

The underlay and fabric services are operational, and the gateway cutover has been planned. What belongs at the boundary between the traditional VLAN and the corresponding fabric segment?

Accepted Answer

A Layer 2 border handoff bridging the traditional VLAN into the fabric segment.

Answer

Matching security group tags on the controllers, with the traditional and fabric segments kept separate.

Answer

A Layer 3 border handoff advertising the controller subnet.

Answer

Separate virtual networks for traditional and fabric controllers, with the subnet route shared between them.

Question 10

Two providers advertise 198.51.100.0/24 to an IOS XE router through directly connected eBGP sessions. Both paths are usable; weight, local preference, origin type, and IGP cost to the next hop are equal. Neither path is locally originated, and there are no best-path overrides or multipath configuration.

Path A: AS_PATH 65010 64496; MED 10; peer router ID 1.1.1.1; received 5 minutes ago
Path B: AS_PATH 65020 64496; MED 200; peer router ID 9.9.9.9; received 8 hours ago

Path B was best before Path A arrived and has remained available. Which comparison decides the result?

Accepted Answer

External-path age retains Path B because it was received earlier.

Answer

Peer router ID selects Path A because its lower identifier takes precedence over path age.

Answer

MED selects Path A because it has the lower value, regardless of the neighboring AS.

Answer

External-path age selects Path A because it is newer.

Free ENCOR Practice Questions

Domain 1: Architecture 15% of exam

Question 1

Question 2

Domain 2: Virtualization 10% of exam

Question 3

Domain 3: Infrastructure 30% of exam

Question 4

Question 5

Question 6

Domain 4: Network Assurance 10% of exam

Question 7

Domain 5: Security 20% of exam

Question 8

Question 9

Domain 6: Automation and Artificial Intelligence 15% of exam

Question 10

That's 10 of 1,030