Question 550
An operator mirrors a saturated 10-Gbps source to a 1-Gbps SPAN destination and expects lossless packet capture. During troubleshooting: A trace omits bursts that are visible in source interface statistics. Which underlying cause best explains the recorded behavior?
- The implementation uses a Layer 2 RSPAN assumption across a network lacking VLAN continuity.
- No correctly attached local SPAN destination/source session exists.
- The monitor destination is oversubscribed and silently drops mirrored packets.
- Flexible NetFlow records or monitor attachment are not collecting the required per-flow keys.
Explanation
Correct Answer
C:The actual technical cause is: The monitor destination is oversubscribed and silently drops mirrored packets. It specifically explains the observation: a trace omits bursts that are visible in source interface statistics. The correcting configuration is: match the capture destination bandwidth to the offered mirrored load or reduce capture scope before relying on results.
Incorrect Answers
A:That diagnosis is supported by a different symptom: Traffic capture fails across a routed hop even though the source port sees packets. Here the recorded observation is: a trace omits bursts that are visible in source interface statistics. The applicable cause is: the monitor destination is oversubscribed and silently drops mirrored packets.
B:That diagnosis is supported by a different symptom: The analyzer receives no frames even though the source interface is forwarding normally. Here the recorded observation is: a trace omits bursts that are visible in source interface statistics. The applicable cause is: the monitor destination is oversubscribed and silently drops mirrored packets.
D:That diagnosis is supported by a different symptom: A collector displays byte totals but no per-application flow records from the router. Here the recorded observation is: a trace omits bursts that are visible in source interface statistics. The applicable cause is: the monitor destination is oversubscribed and silently drops mirrored packets.
Question 551
An operator mirrors a saturated 10-Gbps source to a 1-Gbps SPAN destination and expects lossless packet capture. The initial change is: Match the capture destination bandwidth to the offered mirrored load or reduce capture scope before relying on results. Which continuing control most directly prevents a recurrence of the documented problem: A trace omits bursts that are visible in source interface statistics.
- Verify exporter connectivity, sampling and record templates after device upgrades.
- Limit SPAN sessions to needed ports and avoid production throughput overload on destination links.
- Check ERSPAN destination routability and GRE/MTU handling when moving analyzers.
- Note capture capacity and loss limitations in every performance incident report.
Explanation
Correct Answer
D:The continuing protective control is: Note capture capacity and loss limitations in every performance incident report. This addresses the underlying failure mechanism: the monitor destination is oversubscribed and silently drops mirrored packets. The corresponding operational check is: compare source byte rate with destination dropped/missed capture counters under load.
Incorrect Answers
A:That control reduces a separate risk: Flexible NetFlow records or monitor attachment are not collecting the required per-flow keys. For the described design, the recurring risk arises from: the monitor destination is oversubscribed and silently drops mirrored packets. The specific required safeguard is: note capture capacity and loss limitations in every performance incident report.
B:That control reduces a separate risk: No correctly attached local SPAN destination/source session exists. For the described design, the recurring risk arises from: the monitor destination is oversubscribed and silently drops mirrored packets. The specific required safeguard is: note capture capacity and loss limitations in every performance incident report.
C:That control reduces a separate risk: The implementation uses a Layer 2 RSPAN assumption across a network lacking VLAN continuity. For the described design, the recurring risk arises from: the monitor destination is oversubscribed and silently drops mirrored packets. The specific required safeguard is: note capture capacity and loss limitations in every performance incident report.
Question 552
A WAN manager wants a recurring reachability/latency measurement from the branch router to a data-center target independent of user applications. The incident evidence is: The monitoring dashboard shows no probes after the IPSLA operation was configured. Which targeted configuration or design change best addresses the failure?
- Test the affected TCP flow and use supported protocol-specific traceroute/ACL counters rather than relying on ICMP reachability alone.
- Associate the supported IPSLA reachability operation with object tracking and the conditional route.
- Use a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss.
- Configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target.
Explanation
Correct Answer
D:The required correction is: Configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target. The underlying failure mechanism is: The IPSLA operation was not scheduled or started. Verify success by carrying out this direct test: inspect IPSLA success, RTT and last return code over controlled test intervals.
Incorrect Answers
A:The needed correction is to configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target.
B:Associate the supported IPSLA reachability operation with object tracking and the conditional route would not configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target.
C:Using a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss would not configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target.
Question 553
A WAN manager wants a recurring reachability/latency measurement from the branch router to a data-center target independent of user applications. The proposed remedy is: Configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target. Which observation would most directly confirm that remedy works as intended?
- Compare UDP-jitter output under controlled impaired links against basic ICMP RTT.
- Disable the target path and verify track state causes correct static-route failover.
- Inspect IPSLA success, RTT and last return code over controlled test intervals.
- Compare port443 connection success, filtering counters and ICMP response under the same source route.
Explanation
Correct Answer
C:The decisive acceptance observation is: Inspect IPSLA success, RTT and last return code over controlled test intervals. This tests the working mechanism, while the original incident was: the monitoring dashboard shows no probes after the IPSLA operation was configured.
Incorrect Answers
A:This test measures a different behavior: Compare UDP-jitter output under controlled impaired links against basic ICMP RTT. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect IPSLA success, RTT and last return code over controlled test intervals.
B:This test measures a different behavior: Disable the target path and verify track state causes correct static-route failover. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect IPSLA success, RTT and last return code over controlled test intervals.
D:This test measures a different behavior: Compare port443 connection success, filtering counters and ICMP response under the same source route. It does not establish the target outcome. For the documented fault, the direct acceptance test is: inspect IPSLA success, RTT and last return code over controlled test intervals.
Question 554
A WAN manager wants a recurring reachability/latency measurement from the branch router to a data-center target independent of user applications. During troubleshooting: The monitoring dashboard shows no probes after the IPSLA operation was configured. Which underlying cause best explains the recorded behavior?
- The IPSLA operation was not scheduled or started.
- Basic ICMP RTT does not measure the interpacket-delay variation and loss affecting voice quality.
- The route has no operative track dependency tied to IPSLA status.
- ICMP echo reachability does not prove that TCP443 is allowed through middleboxes.
Explanation
Correct Answer
A:The actual technical cause is: The IPSLA operation was not scheduled or started. It specifically explains the observation: the monitoring dashboard shows no probes after the IPSLA operation was configured. The correcting configuration is: configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target.
Incorrect Answers
B:That diagnosis is supported by a different symptom: Voice breaks up while ICMP round-trip latency remains acceptable. Here the recorded observation is: the monitoring dashboard shows no probes after the IPSLA operation was configured. The applicable cause is: the IPSLA operation was not scheduled or started.
C:That diagnosis is supported by a different symptom: The primary static route remains in the RIB after its monitored endpoint stops responding. Here the recorded observation is: the monitoring dashboard shows no probes after the IPSLA operation was configured. The applicable cause is: the IPSLA operation was not scheduled or started.
D:That diagnosis is supported by a different symptom: An engineer closes the ticket because `ping` succeeds, although the application still cannot connect. Here the recorded observation is: the monitoring dashboard shows no probes after the IPSLA operation was configured. The applicable cause is: the IPSLA operation was not scheduled or started.
Question 555
A WAN manager wants a recurring reachability/latency measurement from the branch router to a data-center target independent of user applications. Select TWO complementary decisions: the direct technical remedy and a safeguard against recurrence. A verification-only step cannot substitute for either action.
- Use a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss.
- Validate backup-route reachability and avoid tracking only a local interface when remote path health matters.
- Configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target.
- Test the affected TCP flow and use supported protocol-specific traceroute/ACL counters rather than relying on ICMP reachability alone.
- Audit operation schedules and reaction thresholds when deploying synthetic monitoring.
Explanation
Correct Answers
C:The required correction is: Configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target. The underlying failure mechanism is: The IPSLA operation was not scheduled or started. Verify success by carrying out this direct test: inspect IPSLA success, RTT and last return code over controlled test intervals.
E:The continuing protective control is: Audit operation schedules and reaction thresholds when deploying synthetic monitoring. This addresses the underlying failure mechanism: the IPSLA operation was not scheduled or started. The corresponding operational check is: inspect IPSLA success, RTT and last return code over controlled test intervals.
Incorrect Answers
A:A UDP-jitter probe measures a different synthetic traffic profile; the specifically requested recurring ICMP reachability check still needs an ICMP echo operation.
B:That control reduces a separate risk: The route has no operative track dependency tied to IPSLA status. For the described design, the recurring risk arises from: the IPSLA operation was not scheduled or started. The specific required safeguard is: audit operation schedules and reaction thresholds when deploying synthetic monitoring.
D:An on-demand TCP trace is useful for troubleshooting one flow, but it is not the scheduled router-originated reachability measurement requested.
Question 556
An IPSLA probe measures round-trip delay but the business needs a failover route only when the monitored endpoint becomes unreachable. The incident evidence is: The primary static route remains in the RIB after its monitored endpoint stops responding. Which targeted configuration or design change best addresses the failure?
- Associate the supported IPSLA reachability operation with object tracking and the conditional route.
- Use traceroute with an appropriate source address and protocol to identify the point where replies stop or diverge.
- Configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target.
- Use a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss.
Explanation
Correct Answer
A:The required correction is: Associate the supported IPSLA reachability operation with object tracking and the conditional route. The underlying failure mechanism is: The route has no operative track dependency tied to IPSLA status. Verify success by carrying out this direct test: disable the target path and verify track state causes correct static-route failover.
Incorrect Answers
B:Using traceroute with an appropriate source address and protocol to identify the point where replies stop or diverge would not address the need for associate the supported IPSLA reachability operation with object tracking and the conditional route.
C:Configuring an IPSLA ICMP echo operation and a schedule with the intended source interface and target would not address the need for associate the supported IPSLA reachability operation with object tracking and the conditional route.
D:Using a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss would not address the need for associate the supported IPSLA reachability operation with object tracking and the conditional route.
Question 557
An IPSLA probe measures round-trip delay but the business needs a failover route only when the monitored endpoint becomes unreachable. The proposed remedy is: Associate the supported IPSLA reachability operation with object tracking and the conditional route. Which observation would most directly confirm that remedy works as intended?
- Compare UDP-jitter output under controlled impaired links against basic ICMP RTT.
- Inspect IPSLA success, RTT and last return code over controlled test intervals.
- Compare traceroute hop sequence with expected routing and a known-good source.
- Disable the target path and verify track state causes correct static-route failover.
Explanation
Correct Answer
D:The decisive acceptance observation is: Disable the target path and verify track state causes correct static-route failover. This tests the working mechanism, while the original incident was: the primary static route remains in the RIB after its monitored endpoint stops responding.
Incorrect Answers
A:This test measures a different behavior: Compare UDP-jitter output under controlled impaired links against basic ICMP RTT. It does not establish the target outcome. For the documented fault, the direct acceptance test is: disable the target path and verify track state causes correct static-route failover.
B:This test measures a different behavior: Inspect IPSLA success, RTT and last return code over controlled test intervals. It does not establish the target outcome. For the documented fault, the direct acceptance test is: disable the target path and verify track state causes correct static-route failover.
C:This test measures a different behavior: Compare traceroute hop sequence with expected routing and a known-good source. It does not establish the target outcome. For the documented fault, the direct acceptance test is: disable the target path and verify track state causes correct static-route failover.
Question 558
An IPSLA probe measures round-trip delay but the business needs a failover route only when the monitored endpoint becomes unreachable. During troubleshooting: The primary static route remains in the RIB after its monitored endpoint stops responding. Which underlying cause best explains the recorded behavior?
- Basic ICMP RTT does not measure the interpacket-delay variation and loss affecting voice quality.
- Ping to the local next hop only confirms first-hop reachability, not the entire routed path.
- The route has no operative track dependency tied to IPSLA status.
- The IPSLA operation was not scheduled or started.
Explanation
Correct Answer
C:The actual technical cause is: The route has no operative track dependency tied to IPSLA status. It specifically explains the observation: the primary static route remains in the RIB after its monitored endpoint stops responding. The correcting configuration is: associate the supported IPSLA reachability operation with object tracking and the conditional route.
Incorrect Answers
A:That diagnosis is supported by a different symptom: Voice breaks up while ICMP round-trip latency remains acceptable. Here the recorded observation is: the primary static route remains in the RIB after its monitored endpoint stops responding. The applicable cause is: the route has no operative track dependency tied to IPSLA status.
B:That diagnosis is supported by a different symptom: A simple ping of the first WAN router succeeds while the remote subnet remains unreachable. Here the recorded observation is: the primary static route remains in the RIB after its monitored endpoint stops responding. The applicable cause is: the route has no operative track dependency tied to IPSLA status.
D:That diagnosis is supported by a different symptom: The monitoring dashboard shows no probes after the IPSLA operation was configured. Here the recorded observation is: the primary static route remains in the RIB after its monitored endpoint stops responding. The applicable cause is: the route has no operative track dependency tied to IPSLA status.
Question 559
An IPSLA probe measures round-trip delay but the business needs a failover route only when the monitored endpoint becomes unreachable. Select THREE complementary actions: the technical remedy, a direct verification, and the ongoing safeguard. Evidence from an unrelated mechanism is not a substitute for these three responsibilities.
- Validate backup-route reachability and avoid tracking only a local interface when remote path health matters.
- Associate the supported IPSLA reachability operation with object tracking and the conditional route.
- Use a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss.
- Inspect IPSLA success, RTT and last return code over controlled test intervals.
- Disable the target path and verify track state causes correct static-route failover.
- Retain source-specific traceroute baselines and verify return-path filtering before declaring a hop down.
Explanation
Correct Answers
A:The continuing protective control is: Validate backup-route reachability and avoid tracking only a local interface when remote path health matters. This addresses the underlying failure mechanism: the route has no operative track dependency tied to IPSLA status. The corresponding operational check is: disable the target path and verify track state causes correct static-route failover.
B:The required correction is: Associate the supported IPSLA reachability operation with object tracking and the conditional route. The underlying failure mechanism is: The route has no operative track dependency tied to IPSLA status. Verify success by carrying out this direct test: disable the target path and verify track state causes correct static-route failover.
E:The decisive acceptance observation is: Disable the target path and verify track state causes correct static-route failover. This tests the working mechanism, while the original incident was: the primary static route remains in the RIB after its monitored endpoint stops responding.
Incorrect Answers
C:The needed correction is to associate the supported IPSLA reachability operation with object tracking and the conditional route.
D:This test measures a different behavior: Inspect IPSLA success, RTT and last return code over controlled test intervals. It does not establish the target outcome. For the documented fault, the direct acceptance test is: disable the target path and verify track state causes correct static-route failover.
F:That control reduces a separate risk: Ping to the local next hop only confirms first-hop reachability, not the entire routed path. For the described design, the recurring risk arises from: the route has no operative track dependency tied to IPSLA status. The specific required safeguard is: validate backup-route reachability and avoid tracking only a local interface when remote path health matters.
Question 560
A business application uses UDP voice flows and a manager measures only ping latency to infer voice quality. The incident evidence is: Voice breaks up while ICMP round-trip latency remains acceptable. Which targeted configuration or design change best addresses the failure?
- Use a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss.
- Associate the supported IPSLA reachability operation with object tracking and the conditional route.
- Attach the correct flow monitor to the intended ingress or egress direction supported by the platform.
- Configure an IPSLA ICMP echo operation and a schedule with the intended source interface and target.
Explanation
Correct Answer
A:The required correction is: Use a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss. The underlying failure mechanism is: Basic ICMP RTT does not measure the interpacket-delay variation and loss affecting voice quality. Verify success by carrying out this direct test: compare UDP-jitter output under controlled impaired links against basic ICMP RTT.
Incorrect Answers
B:Associate the supported IPSLA reachability operation with object tracking and the conditional route would not meet the need for a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss.
C:Attaching the correct flow monitor to the intended ingress or egress direction supported by the platform would not meet the need for a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss.
D:Configuring an IPSLA ICMP echo operation and a schedule with the intended source interface and target would not meet the need for a supported IPSLA UDP-jitter operation when the platform supports the intended test to measure jitter/packet loss.
Implementing Cisco Enterprise Network Core Technologies (ENCOR) (350-401) Practice Tests