Free and Premium Cisco 350-401 Dumps Questions Answers

1 and 3 – Configuration

4 and 5 – Orchestration

The correct answer is C. Data.

Cisco SD-WAN architecture is divided into three main planes:

Management Plane

Handled by vManage

Used for configuration and monitoring

Control Plane

Handled by vSmart (OMP protocol)

Responsible for routing information exchange and policy distribution

Data Plane

Built using IPsec tunnels between WAN Edge devices

Responsible for forwarding actual user/application traffic between sites

The data plane is the plane that:

Carries user traffic

Transports data between SD-WAN sites

Uses secure tunnels (IPsec) for communication

A. IPsec IPsec is a technology used within the data plane, not a plane itself.

B. Management Used for configuration and orchestration, not traffic forwarding.

D. Control Used for routing and policy decisions, not actual traffic transport.

Memorize SD-WAN planes:

Management Plane → vManage (configuration)

Control Plane → vSmart (routing/policy via OMP)

Data Plane → IPsec tunnels (user traffic transport)

User traffic = Data Plane

The correct answer is B. TLS.

In Cisco Catalyst SD-WAN, the architecture separates:

Control Plane → Secure communication between controllers and edge devices

Data Plane → Encrypted tunnels carrying user traffic

The control plane (between vSmart, vBond, vManage, and WAN Edge routers) uses:

TLS (Transport Layer Security)

In some cases also DTLS, depending on configuration

These protocols provide:

Authentication

Encryption

Integrity protection

Thus, TLS is used to establish secure control plane adjacencies.

A. IPsec Used for data plane encryption (IPsec tunnels), not control plane.

C. IKE Used for key exchange in IPsec, not for SD-WAN control plane adjacencies.

D. ESP Part of IPsec (data plane encryption), not control plane.

Memorize this SD-WAN separation:

Control Plane → TLS / DTLS

Data Plane → IPsec (ESP encapsulation)

This distinction is frequently tested in ENCOR exams.

The correct answer is B. TLS or SSL for communication.

In basic API authentication, credentials (such as username and password) are often transmitted using Base64 encoding, which is not encrypted. This makes them vulnerable to sniffer (packet capture) attacks if sent over an unencrypted channel.

TLS (Transport Layer Security) and its predecessor SSL provide encryption of the communication channel.

This ensures that even if packets are captured, the credentials remain confidential and unreadable.

Cisco documentation emphasizes that APIs (RESTCONF, HTTP-based APIs) should use HTTPS (HTTP over TLS) to secure credentials in transit.

A. VPN connection between client and server While a VPN encrypts traffic, it is not specifically required for API authentication security. The standard and expected method is TLS/HTTPS.

C. AAA services to authenticate the API AAA controls who can access, but it does not encrypt credentials in transit.

D. next-generation firewall A firewall provides traffic filtering and threat protection but does not directly secure credential transmission in basic API authentication.

Basic Authentication = NOT secure by itself

Always pair it with HTTPS (TLS encryption)

Rule to remember:

If credentials travel over the network → encrypt with TLS

1 and 3 – Configuration

4 and 5 – Orchestration

The correct configuration is option D because Cisco AAA method lists are processed from left to right. The existing configuration uses the default login and exec authorization method lists with only the TACACS+ group. That means if the TACACS+ server is unreachable, authentication and authorization fail unless another method is explicitly listed after the TACACS+ group. Adding local after group tacacs+ creates a fallback sequence: try TACACS+ first; if no TACACS+ response is available, use the local user database. Option C is wrong because it replaces TACACS+ with local authentication only, removing centralized AAA as the preferred method. Option B creates a named method list called FALLBACK, but it does not apply to the default login or exec process shown in the running configuration. Option A is not valid Cisco IOS AAA syntax for this requirement. This is a device-management security question focused on resilient AAA design. References/topics: ENCOR Infrastructure Security, AAA, TACACS+, local fallback, device administration, authorization method lists.

A next-generation firewall protects against more than basic IP, port, and protocol violations. Its key value is application visibility and control. In a data center, an NGFW can identify applications regardless of port, inspect application behavior, enforce policy based on application identity, and block malicious or risky applications that traditional firewalls may allow if they use permitted ports such as TCP 80 or 443. Therefore, option D is the best answer. DDoS protection is usually handled by dedicated DDoS mitigation systems, upstream scrubbing services, rate limiting, or cloud-based DDoS protection rather than being the defining function of a data center NGFW. Unauthorized analyzers and rogue APs are not the primary threat categories addressed by a data center NGFW; rogue AP detection is more aligned with wireless security and WIPS/WIDS. The key ENCOR concept is that NGFWs add application awareness, user/context-based policy, intrusion prevention, malware inspection, and advanced threat defense to traditional stateful firewalling. References/topics: ENCOR Security, Cisco Threat Defense, next-generation firewall, application control, malware prevention, data center security.

The correct answer is B. to connect wired endpoints to the SD-Access fabric.

In Cisco SD-Access, the fabric edge node is the device that provides access for endpoints into the fabric. It is the point where user devices such as PCs, phones, printers, and access points attach to the SD-Access network. The edge node handles endpoint onboarding into the fabric and applies the appropriate segmentation and policy.

A fabric edge node is specifically responsible for:

Connecting wired endpoints to the fabric

Serving as the access-layer entry point into the SD-Access fabric

Enforcing policy and segmentation for connected endpoints

Extending the fabric to end hosts

This is the main role of the edge node in the SD-Access architecture.

A. to connect the fusion router to the SD-Access fabric This is not the role of the fabric edge node. The fusion router is used outside the fabric to provide connectivity between the fabric and external networks.

C. to advertise fabric IP address space to external networks This function is associated with the border node, not the edge node. The border node connects the fabric to external domains and exchanges reachability information.

D. to connect external Layer 3 networks to the SD-Access fabric This is also the function of the border node, not the edge node.

Remember these SD-Access node roles clearly:

Edge node = connects endpoints

Border node = connects to external networks

Control-plane node = maintains endpoint-to-location mappings

Fusion router = external routing/services outside the fabric

Edge node = endpoint access into the fabric

The correct snippet is option B because json.dump(Devices, OutFile) serializes the Python data structure and writes the resulting JSON directly to the open file object. The file is opened in write mode with open( " devices.json " , " w " ), and OutFile.close() closes the file after writing. Option A is wrong because json.load() reads JSON from a file and converts it into a Python object; it does not write a Python object to disk. It is also being used on a file opened in write mode, which is logically incorrect. Option C writes str(Devices), which produces a Python string representation of the dictionary, not standards-compliant JSON. That output may use single quotes and Python-specific formatting, which is not proper JSON. Option D uses json.dumps(Devices), which returns a JSON-formatted string, but it does not write that string to the file because the return value is ignored. ENCOR automation questions often test the difference between dump, dumps, load, and loads. References/topics: ENCOR Automation, Python, JSON, json.dump(), json.dumps(), file output, API data formatting.

The correct answer is A. interface between the controller and the network devices.

In Cisco controller-based architectures such as Cisco DNA Center / Cisco Catalyst Center, APIs are generally described in two directions:

Northbound APIs → used by external applications, users, or orchestration systems to communicate with the controller

Southbound APIs → used by the controller to communicate with the network devices

A southbound API provides the communication path between the controller and the infrastructure devices such as switches, routers, and wireless devices. This is how the controller pushes configuration, collects operational data, and manages the network.

B. interface between the controller and the consumer This describes a northbound API, not a southbound API.

C. NETCONF API interface for orchestrator communication Orchestrator communication is generally associated with northbound integration, not the fundamental definition of Cisco DNA southbound APIs.

D. RESTful API interface for orchestrator communication This also describes northbound API behavior, where external systems communicate with the controller.

Remember this controller model clearly:

Northbound API = controller ↔ applications / orchestration / users

Southbound API = controller ↔ network devices

Southbound = toward the infrastructure

The correct answer is B. To route video traffic through a dedicated link.

Policy-Based Routing (PBR) allows the router to make forwarding decisions based on policies such as source, destination, application, or other match criteria, instead of relying only on the routing table. Cisco documentation explains that PBR gives more control over routing by reducing reliance on routes learned from routing protocols, and that it can route traffic according to a defined policy.

This means an engineer can identify video traffic and force it to use a specific dedicated path or link, even if that path is not the normal best path chosen by the routing table. Cisco also notes that set ip next-hop makes the system use policy routing first and then the routing table, which confirms that PBR can override normal routing behavior to send selected traffic to a chosen next hop.

Video traffic is often sensitive to delay, jitter, and packet loss. With PBR, the engineer can match that traffic and send it over a dedicated WAN link or preferred path that better supports real-time applications. This is a classic use case for PBR.

A. To route video traffic using the shortest path to the destination This is normally the job of the routing table and routing protocols, not PBR. PBR is used when the engineer wants to override normal path selection.

C. To use multicast for video traffic transmission Multicast is a separate forwarding technology and is not the purpose of PBR.

D. To perform traffic shaping to avoid video traffic delay Traffic shaping is a QoS function, not a routing decision function. PBR selects paths; it does not shape traffic.

ENCOR exam point:

Use PBR when traffic must follow a policy-defined path rather than the path chosen by standard routing protocol metrics.

Priority 1: D

Priority 2: E

Priority 3: C

Priority 4: F

Cisco AAA method lists are processed from left to right. The command aaa authentication login default group ACE group AAA_RADIUS local-case defines the default login authentication sequence. The first method is the named AAA server group ACE, so the first priority is the AAA servers of the ACE group. If those servers do not respond or cannot authenticate the user, IOS tries the next method, which is the named AAA server group AAA_RADIUS. If that also fails, the router uses local-case, which checks the local username database with case-sensitive username matching. This is different from the normal local method, which does not enforce case-sensitive username comparison in the same way. If none of the configured methods succeeds, authentication fails and login is denied. The TACACS-specific option is not selected because the shown command uses a named AAA server group, not the literal group tacacs+ keyword. The non-case-sensitive local method is also not selected because the command explicitly uses local-case. References/topics: ENCOR Infrastructure Security, AAA method lists, login authentication, named server groups, local-case fallback behavior.

Cisco TrustSec classifies traffic using Security Group Tags, commonly called SGTs. An SGT represents the security group identity assigned to a user, device, or endpoint session. Instead of relying only on VLANs, IP subnets, or ACLs tied to topology, TrustSec allows policy to follow the identity of the endpoint. That makes option B correct. VLAN-based classification is less flexible because VLANs are tied to Layer 2 segmentation and network placement. MAC addresses can identify devices but are not the TrustSec policy classification mechanism. IP addresses are commonly used in traditional ACLs, but TrustSec’s purpose is to reduce dependence on IP-based segmentation by using group-based policy. Once traffic is tagged with an SGT, network devices can enforce Security Group ACLs, also called SGACLs, based on source and destination security groups. This supports scalable segmentation across campus and enterprise networks. The ENCOR concept is identity-based segmentation and policy abstraction. References/topics: ENCOR Security, Cisco TrustSec, Security Group Tag, SGACL, identity-based access control, scalable group-based segmentation.

The input service policy shown in the exhibit matches traffic with DSCP value 1 and applies a QoS set action to rewrite that marking to DSCP 63. Therefore, packets entering interface Fa7/0/2 with DSCP 1 are remarked to DSCP 63, making option B correct. The second part of the configuration defines a class map matching DSCP 63 and a policy map using bandwidth percent 50. That behavior belongs to class-based queuing/scheduling, where DSCP63-marked traffic is placed into a class that receives a bandwidth allocation. In the given option set, option C best represents this queuing behavior. Option D is wrong because the service policy explicitly changes the DSCP value. Option E is not accurate because classification is not triggered by reaching 50 percent bandwidth; classification occurs by matching packet fields such as DSCP. Option A is less precise than C because the shown policy behavior is class-based queuing with a bandwidth allocation. The important ENCOR concept is the separation between marking on ingress and queuing/scheduling on egress. References/topics: ENCOR Infrastructure, QoS, MQC, class maps, policy maps, DSCP marking, CBWFQ, bandwidth percent.

In Cisco SD-Access, the fabric roles are clearly separated. The fabric edge node connects endpoints to the fabric and encapsulates user traffic into VXLAN. The control plane node runs the LISP control-plane function and maintains the endpoint ID to routing locator mapping database. That makes option C correct. The border node connects the SD-Access fabric to external networks, such as the data center, WAN, internet edge, or shared services. Therefore, the border node is required when fabric endpoints must communicate with nonfabric resources, which makes option B correct. Option A is wrong because the full endpoint mapping database belongs to the control plane node, not the border node. Option D is wrong because endpoints connect to fabric edge nodes, not normally to border nodes. Option E is also wrong because the control plane node is not in the data-forwarding path for normal user traffic; it resolves mappings. Data traffic flows through the fabric using VXLAN encapsulation after control-plane resolution. References/topics: ENCOR Architecture, Cisco SD-Access, fabric edge node, fabric border node, control plane node, LISP, VXLAN.

Blank 1: event manager

Blank 2: applet

Blank 3: event syslog

Blank 4: pattern

Blank 5: mail server

The correct EEM structure begins with event manager applet Enable_Interface_And_Alert. This creates the Embedded Event Manager policy and names the applet. The trigger must detect a syslog message indicating that GigabitEthernet0/1 changed state to administratively down, so the event line must use event syslog pattern " Interface GigabitEthernet0/1, changed state to administratively down " . After the trigger occurs, the configured CLI actions enter enable mode, move into configuration mode, select the interface, issue no shutdown, and exit configuration mode. The final action sends an email alert. Cisco EEM mail syntax uses mail server followed by the SMTP server and mail parameters such as recipient, sender, subject, and body. The snippets must therefore form valid IOS EEM syntax, not just logical statements. This is an automation and operational-notification task: EEM reacts to a device event and performs corrective action while also communicating the incident. References/topics: ENCOR Automation, Embedded Event Manager, syslog event triggers, CLI action applets, operational alerting, SMTP notification.

The correct answer is D.

To meet the requirement, the configuration must do two things:

Permit only the 10.10.10.0/24 subnet to access the VTY lines

Allow only a secure remote access protocol, which is SSH

The correct Cisco IOS configuration is:

access-list 23 permit 10.10.10.0 0.0.0.255

line vty 0 15

access-class 23 in

transport input ssh

access-list 23 permit 10.10.10.0 0.0.0.255 This correctly matches the subnet 10.10.10.0/24 using the proper wildcard mask 0.0.0.255.

line vty 0 15 This applies the restriction to all VTY lines, not only a subset.

access-class 23 in This filters incoming remote access connections to the router.

transport input ssh This allows only SSH, which is encrypted and secure, and prevents Telnet or other clear-text remote access protocols.

A is incorrect because:

access-class 23 out filters outbound connections from the VTY lines, not inbound management access.

transport input all allows insecure protocols such as Telnet.

B is incorrect because:

255.255.255.0 is a subnet mask, not a wildcard mask, so the ACL syntax is wrong for a standard ACL entry.

C is incorrect because:

It applies only to VTY 0 4, while the router also has VTY 5 15 configured.

This leaves other VTY lines unrestricted, which does not fully meet the requirement.

For secure remote management on Cisco devices:

Use transport input ssh to disable Telnet

Use access-class < ACL > in on VTY lines to restrict who can connect

Use the correct wildcard mask for the subnet

For 10.10.10.0/24, the wildcard mask is:

0.0.0.255

So the complete secure solution is:

restrict inbound VTY access + allow only SSH + apply to all VTY lines

Auto-RP is used in Protocol Independent Multicast sparse-mode environments to distribute rendezvous point information automatically. In PIM sparse mode, multicast routers must know which RP is responsible for specific multicast group ranges. Without a dynamic RP-discovery mechanism, administrators would have to configure RP information manually across routers. Auto-RP solves that by allowing candidate RPs to announce themselves and mapping agents to advertise group-to-RP mappings throughout the multicast domain. Therefore, option B is correct. Option A is incorrect because Auto-RP does not distribute IGMP traffic; IGMP operates between hosts and local multicast routers to manage group membership. Option C is wrong because Auto-RP does not automate leaf-router configuration generally; it specifically distributes RP mapping information. Option D is also inaccurate because Auto-RP does not perform an election in the same way as BSR. It advertises candidate RP and mapping-agent information so routers can learn RP mappings. The key ENCOR concept is multicast control-plane discovery for PIM sparse-mode RP selection. References/topics: ENCOR multicast, PIM sparse mode, Auto-RP, rendezvous point discovery, multicast group-to-RP mapping.

The correct answer is D.

OSPF and EIGRP use different multicast addresses for exchanging routing information:

OSPF uses:

224.0.0.5 → AllSPFRouters

224.0.0.6 → AllDRouters

EIGRP uses:

224.0.0.10

This is a well-known operational difference between the two protocols and is commonly tested in Cisco ENCOR.

A. OSPF uses IP protocol number 88. EIGRP uses IP protocol number 89. This is reversed.

EIGRP = IP protocol 88

OSPF = IP protocol 89

B. OSPF uses a default hello timer of 5 seconds. EIGRP uses a default hello timer of 10 seconds. This is incorrect.

On most broadcast and point-to-point networks, OSPF default hello = 10 seconds

EIGRP default hello = 5 seconds on high-speed links

C. OSPF uses an administrative distance of 115. EIGRP uses an administrative distance of 160. This is also incorrect.

OSPF AD = 110

EIGRP internal AD = 90

EIGRP external AD = 170

Memorize these protocol identifiers:

OSPF

Protocol number: 89

Multicast: 224.0.0.5 / 224.0.0.6

EIGRP

Protocol number: 88

Multicast: 224.0.0.10

The ntp broadcast command under an interface configures the router to send NTP broadcast packets out that interface. In this exhibit, the command is applied under GigabitEthernet0/1, so R1 will broadcast NTP updates onto that connected segment. Option C is therefore correct. Option A would require the device to be configured as an NTP broadcast client, commonly with ntp broadcast client, so merely configuring ntp broadcast does not make the interface receive broadcast time updates. Option B is incomplete because the ntp server commands configure R1 to use specified unicast NTP servers as time sources, but the interface-level question is specifically about the effect of ntp broadcast. Option D is wrong because a single ntp broadcast command does not configure both send and receive behavior. The ENCOR point is that NTP can operate in different modes: unicast client/server, broadcast server, and broadcast client. The command location matters: global ntp server points to time sources, while interface ntp broadcast advertises time to a segment. References/topics: ENCOR Infrastructure Services, NTP, time synchronization, interface-level NTP broadcast behavior.

The correct answer is B. Time-consuming configuration and maintenance .

In a traditional WAN architecture , configurations are typically performed manually on each device (router-by-router basis) . This leads to:

Increased operational overhead

Slower deployment times

Higher chances of configuration inconsistency

Difficult scalability

According to Cisco ENCOR (350-401) architecture principles, traditional WANs lack centralized orchestration, making configuration and maintenance time-consuming and complex .

In contrast, Cisco Catalyst SD-WAN introduces:

Centralized management and control (via vManage, vSmart, vBond)

Policy-based automation

Zero-touch provisioning (ZTP)

Simplified operations and faster deployment

Now, why the other options are incorrect:

A. Centralized reachability, security, and application policies → This is a defining feature of Cisco SD-WAN , not traditional WAN.

C. Low complexity and increased overall solution scale → SD-WAN is specifically designed to reduce complexity and improve scalability .

D. Operates over DTLS/TLS-authenticated and secured tunnels → Cisco SD-WAN uses secure control connections (DTLS/TLS) , which is not a characteristic of traditional WAN .

Final Concept (ENCOR Exam Focus):

Traditional WAN = Manual, complex, time-consuming

Cisco SD-WAN = Centralized, automated, scalable, secure

Solution:

R1

en

Conf t

Router ospf 10

Router-id 10.x.x.x – lo0 address

Int range lo0, e0/0-1

Ip ospf 10 area 0

Exit

wr

R2

Router ospf 10

Area 10 range 10.1.0.0 255.255.0.0

exit

wr

R3

Router ospf 10

Area 10 range 10.2.0.0 255.255.0.0

Exit

Wr

OR

Solution:

Sw10

config t

no int po2

int et0/0

channel-group 2 mode active

no shut

spanning-tree vlan 10a pri 0

wr

Solution:

Sw10

config t

no int po20

int et0/0

channel-group 20 mode active

no shut

spanning-tree vlan 20 pri 0

wr

Verification:-

Solution:-

Copy run start

Solution:-

Default int range et0/0-1

Int range e0/0 – 1

Sw trunk encap dot1

Switch mode trunk

Channel-group 2 mode passive

No shut

Spanning-tree vlan 10 priority 0

Spanning-tree vlan 30 priority 0

Solution:

Solution on R1:

R1# copy run start

Verification:

OR

Solution:

R3

Int e0/1

Ip ospf priority 255

End

Copy run start

R2

Int e0/1

Ip ospf network point-to-point

End

Copy run start

R10

Int e0/0

Ip ospf network point-to-point

End

Copy run start

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

VERIFICATION: -

OR

Solution:

Copy run start

Verification:

OR

Solution:

R2

config t

username NetworkAdmin privilege 15 password CiscoENCOR

line vty 0 4

login local

transport input telnet rlogin

exec-timepit 20

Solution:

R2

R3

Solution:

R22

config t

int tunn0

vrf forwarding FINANCE

ip add 10.11.22.2 255.255.255.0

tunn so e0/0

tunn dest 209.165.200.230

no shut

int et0/1

vrf forward FINANCE

ip add 10.22.22.1 255.255.255.252

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

wr

Solution:

R30

Config t

router ospf 10

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 10 a 0

exit

int et0/2

ip ospf 10 a 50

exit

router ospf 10

area 50 range 10.10.0.0 255.255.128.0

area 50 range 10.50.0.0 255.255.128.0

end

Solution:

R1

config t

flow record NetFlow-Record

match ipv4 source address

match ipv4 destination address

collect country bytes

flow exporter NetFlow-Exporter

destination 10.10.1.10

transport udp 9996

flow monitor NetFlow-Monitor

record NetFlow-Record

exporter NetFlow-Exporter

exit

int et0/0

ip flow monitor NetFlow-Monitor input

ip sla 1

http get

frequency 600

exit

ip sla schedule 1 start-time now

wr

Sw1

config t

monitor session 2 source int e0/0

monitor session 2 source int et0/2

monitor session 2 destination interface e1/0

wr

Solution: -

Solution:

router bgp 10

bgp router-id 10.1.1.111

no bgp defa ipv4-unicast

nei 209.165.200.226 remote-as 20

nei 209.165.202.130 remote-as 30

address-family ipv4

neigh 209.165.200.226 activate

neigh 209.165.202.130 activate

network 10.1.1.10 mask 255.255.255.255

network 209.165.201.10 mask 255.255.255.255

network 209.165.201.20 mask 255.255.255.255

wr

Sw10

Config t

no int po1

default int ran et0/0-2

int ran e0/0-2

switchport trunk encap dot1q

switchport mode trunk

channel-group 1 mode active

no shut

wr

Solution:

R30

show ip access-list

config t

ip access-list extended 120

5 permit eigrp any any

wr

R20

config t

ip access-list extended 100

permit tcp 192.168.25.0 0.0.0.255 any eq 23

class-map match-any TELNET

match access-group 100

policy-map CoPP

class TELNET

police 10000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

wr

Solution:

R2

show ip access-list

config t

ip access-list extended 151

5 permit eigrp any any

wr

R3

config t

ip access-list extended 100

permit tcp 192.168.211.0 0.0.0.255 any eq 22

class-map match-any SSH

match access-group 100

policy-map CoPP

class SSH

police 8000 conform-action transmit exceed-action drop

control-plane

service-policy input CoPP

Solution:

Copy run start

Copy run start

Copy run start

Verification:-

OR

Solution:

R22

int tun0

vrf forwarding FINANCE

ip add 10.10.10.2 255.255.255.0

tunn source e0/0

tunnel dest 209.165.200.230

no shut

ip route vrf FINANCE 10.10.111.0 255.255.255.0 tunn0

int et0/1

vrf forwarding FINANCE

ip address 10.22.22.1 255.255.255.252

wr

Verification:-

Solution:

Copy run start

Verification:

OR

Solution:

R1

Config t

Int et0/0

Ip flow monitor Monitor-R1Flow input

Ip flow monitor Monitor-R1Flow output

Exit

Ip sla 1

Icmp-echo 10.12.1.2

Freq 300

Ip sla schedule 1 life foreve start-time now

Sw1

Config t

Monitor session 12 source vlan 12

Monitor session 12 destination interface et1/3

Solution:

R3

Config#int et0/1

config-if#ip ospf priority 255

wr

R20

clear ip ospf process

yes

R10

int et0/0

ip ospf priority 0

wr

R2

clear ip ospf process

yes

Solution:

R10

Copy run start

R20

Copy run start

Verification:

Solution:

R1

Config t

Flow exporter Export-NetFlowENCOR

destination 10.10.1.110

transport udp 2055

exit

flow moni Monitor-NetFlowENCOR

exit

ip sla 1

http

frequ 300

exit

ip sla schedule 1 life forever start-time now

wr

SW1

Config t

Monitor session 7 source interface e0/0

Monitor session 7 destination interface e1/1

End

Wr

Solution:

R30

Config t

router ospf 100

router-id 10.0.1.30

int ran lo0 , e0/0-1

ip ospf 100 a 0

exit

int et0/2

ip ospf 100 a 50

exit

router ospf 30

area 50 range 10.10.0.0 255.255.192.0

area 50 range 10.50.0.0 255.255.192.0

end

wr

Solution:

R1

config

flow exporter Export-NetFlowENCOR

transport udp 2055

ip sla schedule 100 life forever start-time now

wr

Sw1

monitor session 11 source interface e0/2

monitor session 11 destination interface et1/1

wr

OR