Cisco CCNP Enterprise 350-401 ENCOR IP SLA and Catalyst Center Assurance Workflows Practice Test

 

Topic 13 covers ip sla and catalyst center assurance workflows for the Cisco Certified Specialist – Enterprise Core certification. These original practice questions apply the verified 350-401 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the Cisco 350-401 ENCOR Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

Operations needs a lightweight synthetic check every 30 seconds to determine whether a remote router address is reachable and to record round-trip time. No application-port behavior is required. Which IP SLA operation best fits?

1. HTTP GET to the router even though no HTTP service exists.
2. UDP jitter to an arbitrary closed port.
3. SNMP trap from the destination.
4. ICMP echo to the remote router address.
5. SPAN of the local uplink.

Correct Answer: D

 

Correct Answer

Answer D is correct because ICMP echo directly measures reachability and round-trip response for the target IP.

Incorrect Answers

Answer A is incorrect because an application test would introduce an irrelevant service dependency.

Answer B is incorrect because jitter is useful for delay variation/loss measurements and normally relies on an IP SLA responder; it is unnecessary for the stated simple reachability goal.

Answer C is incorrect because a trap is event-driven and does not provide the requested periodic active probe.

Answer E is incorrect because packet mirroring is observational and does not create the requested synthetic reachability probe.

 

Question 2

A voice team wants synthetic measurements of latency variation and packet loss between two IOS XE routers using a UDP test stream. Which operation is most appropriate?

1. UDP jitter IP SLA operation.
2. BGP keepalive measurement.
3. ICMP echo only.
4. TCP connect to port 22.
5. RSPAN session.

Correct Answer: A

 

Correct Answer

Answer A is correct because UDP jitter is designed to measure UDP delay variation, loss and related path characteristics.

Incorrect Answers

Answer B is incorrect because BGP timers are not an IP SLA voice-quality probe.

Answer C is incorrect because ICMP RTT does not provide the same UDP jitter/loss measurement set intended for voice-like traffic.

Answer D is incorrect because a TCP handshake tests service reachability, not UDP jitter variation.

Answer E is incorrect because RSPAN copies real traffic and is not a synthetic SLA probe.

 

Question 3

A UDP jitter IP SLA operation sends packets to a Cisco router at the far end, but the operation repeatedly times out. Ordinary IP reachability works. The far router has no IP SLA responder configured. What should be corrected first?

1. Enable HSRP on both routers.
2. Change the operation to an RSPAN VLAN.
3. Increase the local STP bridge priority.
4. Disable UDP checksums.
5. Configure the far-end IP SLA responder.

Correct Answer: E

 

Correct Answer

Answer E is correct because the responder participates in the UDP jitter measurement exchange and is a stated prerequisite for this operation.

Incorrect Answers

Answer A is incorrect because gateway redundancy is unrelated to the synthetic probe responder.

Answer B is incorrect because traffic mirroring is not a replacement for the configured synthetic test.

Answer C is incorrect because Layer 2 root election does not supply an IP SLA responder.

Answer D is incorrect because the missing responder is the explicit prerequisite issue.

 

Question 4

A router has two WAN interfaces. The synthetic test must follow the same provider path used by applications sourced from Loopback20, but the IP SLA operation currently chooses a different source and exits another WAN. What change best aligns the probe?

1. Set the required IP SLA source.
2. Remove all other WAN routes.
3. Increase the destination TTL only.
4. Create a SPAN destination on Loopback20.
5. Lower the SNMP polling interval.

Correct Answer: A

 

Correct Answer

Answer A is correct because source selection influences the routing/policy context and makes the probe represent the intended traffic.

Incorrect Answers

Answer B is incorrect because that is disruptive and unnecessary when the operation can explicitly select its source.

Answer C is incorrect because TTL does not select the intended source path.

Answer D is incorrect because SPAN does not apply to a logical loopback as a way to source IP SLA.

Answer E is incorrect because SNMP polling does not alter the probe source.

 

Question 5

An engineer fully configures `ip sla 20` but never issues an `ip sla schedule` command. `show ip sla statistics` has no completed measurements. What is missing?

1. A BGP neighbor to the target.
2. An ERSPAN destination.
3. A syslog severity of debugging.
4. Schedule the defined IP SLA operation.
5. A VRRP group.

Correct Answer: D

 

Correct Answer

Answer D is correct because defining an operation and scheduling when it runs are separate steps.

Incorrect Answers

Answer A is incorrect because IP SLA scheduling is independent of BGP adjacency.

Answer B is incorrect because packet mirroring is unrelated. It does not satisfy the stem’s governing point: IP SLA operation definition and scheduling are separate; the operation must be scheduled to execute.

Answer C is incorrect because logging verbosity does not start the operation. It does not satisfy the stem’s governing point: IP SLA operation definition and scheduling are separate; the operation must be scheduled to execute.

Answer E is incorrect because first-hop redundancy does not activate IP SLA. It does not satisfy the stem’s governing point: IP SLA operation definition and scheduling are separate; the operation must be scheduled to execute.

 

Question 6

An ICMP echo IP SLA has a successful latest return code and 12-ms latest RTT. Its historical statistics show 30 timeouts during the previous hour. Which statement is best?

1. The current success proves there were no earlier failures.
2. The target is currently responding, while historical statistics still show prior intermittent failure.
3. The latest RTT should be multiplied by 30 to calculate packet loss.
4. All 30 historical timeouts must be caused by the current destination.
5. The operation must be disabled because successful probes cannot coexist with earlier timeouts.

Correct Answer: B

 

Correct Answer

Answer B is correct because latest state and accumulated history answer different questions.

Incorrect Answers

Answer A is incorrect because the latest result is one observation and does not erase historical counters.

Answer C is incorrect because RTT and timeout counts are different measurements. It does not satisfy the stem’s governing point: Interpret the most recent IP SLA result separately from accumulated historical failures.

Answer D is incorrect because the count indicates failed operations but root cause still needs correlation.

Answer E is incorrect because intermittent paths can naturally produce both. It does not satisfy the stem’s governing point: Interpret the most recent IP SLA result separately from accumulated historical failures.

 

Question 7

An IP SLA ICMP echo waits up to 1000 ms for each response. A probe receives no reply before that timeout. Which conclusion is justified?

1. Jitter is exactly zero.
2. The destination is permanently down.
3. The measured delay is exactly 1000 ms.
4. The path had one additional hop.
5. No valid RTT was measured.

Correct Answer: E

 

Correct Answer

Answer E is correct because timeout is a failure result, not a precise delay sample.

Incorrect Answers

Answer A is incorrect because no successful response does not establish jitter. It does not satisfy the stem’s governing point: A timeout is not a measured RTT equal to the timeout threshold; it indicates no qualifying response arrived in time.

Answer B is incorrect because one timeout cannot establish permanent failure. It does not satisfy the stem’s governing point: A timeout is not a measured RTT equal to the timeout threshold; it indicates no qualifying response arrived in time.

Answer C is incorrect because a timeout means the operation did not receive a qualifying reply within the configured window; actual one-way/round-trip delay is not known.

Answer D is incorrect because hop count cannot be inferred from a timeout alone.

 

Question 8

A UDP jitter operation reports average round-trip latency of 40 ms but jitter rising from 2 ms to 18 ms while average latency stays near 40 ms. What changed most directly?

1. The responder changed the source address.
2. Every packet now takes exactly 18 ms.
3. Path delay variation increased while mean delay stayed similar.
4. Packet loss must be 18 percent.
5. The average latency fell from 40 to 18 ms.

Correct Answer: C

 

Correct Answer

Answer C is correct because jitter describes variation between packet delays rather than the average itself.

Incorrect Answers

Answer A is incorrect because the measurements do not establish a source-address change.

Answer B is incorrect because jitter is not the absolute per-packet latency. It does not satisfy the stem’s governing point: Latency and jitter are distinct: jitter can worsen while average delay remains stable.

Answer D is incorrect because jitter units are delay variation, not loss percentage.

Answer E is incorrect because the stem explicitly says average remains near 40 ms.

 

Question 9

An IP SLA TCP-connect test is intended to verify the application listener at 10.10.10.50:8443. The engineer accidentally configures destination port 443, which is open on a reverse proxy. The test stays successful while the 8443 application is down. What is wrong?

8443. The router needs a lower IP SLA frequency to detect 8443.
8444. The probe targets the wrong service endpoint.
8445. An open port 443 proves every TCP service on the host is healthy.
8446. The probe should use multicast to reach both ports.
8447. TCP connect can test only port 80.

Correct Answer: B

 

Correct Answer

Answer B is correct because success on 443 cannot verify a listener on 8443.

Incorrect Answers

Answer A is incorrect because frequency does not correct the wrong destination port.

Answer C is incorrect because service availability is port/application specific. It does not satisfy the stem’s governing point: Synthetic service checks must target the same protocol/port as the service being validated.

Answer D is incorrect because multicast is irrelevant. It does not satisfy the stem’s governing point: Synthetic service checks must target the same protocol/port as the service being validated.

Answer E is incorrect because TCP-connect operations can target configured TCP ports. It does not satisfy the stem’s governing point: Synthetic service checks must target the same protocol/port as the service being validated.

 

Question 10

An IP SLA operation was scheduled with `life 3600` and started at 08:00. At 10:30 it shows old statistics but no new operations. Reachability to the target is good. What should be checked first?

1. Whether the collector received NetFlow templates.
2. Whether the target enabled STP PortFast.
3. Whether BGP best path changed at 10:30.
4. Whether the scheduled lifetime expired around 09:00.
5. Whether the router is the HSRP active device.

Correct Answer: D

 

Correct Answer

Answer D is correct because a finite life can stop operation execution even though historical statistics remain visible.

Incorrect Answers

Answer A is incorrect because NetFlow is unrelated to IP SLA scheduling. It does not satisfy the stem’s governing point: When IP SLA statistics stop updating, verify that the operation is still scheduled and within its configured lifetime.

Answer B is incorrect because STP edge configuration is unrelated to the synthetic operation schedule.

Answer C is incorrect because the more direct explanation is that the schedule ended long before.

Answer E is incorrect because the operation can run independently of FHRP role unless the design explicitly says otherwise.

 

Question 11

A branch router can run one UDP jitter probe every second or every 60 seconds. The requirement is trend monitoring, and the device is already CPU-constrained. What principle should guide frequency selection?

1. Disable all other monitoring whenever IP SLA runs.
2. Balance detection granularity against probe overhead and the monitoring objective.
3. Use the highest possible frequency because synthetic probes have no resource cost.
4. Use exactly 60 seconds because Cisco requires it for all operations.
5. Make the probe interval shorter than the packet serialization time.

Correct Answer: B

 

Correct Answer

Answer B is correct because frequency should be sufficient for the use case without unnecessary resource consumption.

Incorrect Answers

Answer A is incorrect because that is not inherently required. It does not satisfy the stem’s governing point: Choose IP SLA frequency to meet detection needs while respecting network/device overhead.

Answer C is incorrect because probes consume processing/bandwidth and overly aggressive frequency may distort or burden the device.

Answer D is incorrect because frequency is configurable and should follow the requirement/platform constraints.

Answer E is incorrect because that is not a sensible general monitoring rule.

 

Question 12

An IP SLA probe between two routers reports stable 20-ms RTT and zero loss all day. Users still report a web application is slow because its database backend is overloaded. Which statement is accurate?

1. Replace IP SLA with HSRP.
2. The IP SLA result disproves the user complaint.
3. The database must be on a different IP subnet for the complaint to be valid.
4. Increase jitter calculation to include database CPU.
5. The synthetic path result is one piece of evidence and cannot represent every user/application dependency.

Correct Answer: E

 

Correct Answer

Answer E is correct because probe scope is limited to the operation and endpoints being measured.

Incorrect Answers

Answer A is incorrect because gateway redundancy is not an application performance diagnostic substitute.

Answer B is incorrect because a network-layer synthetic measurement does not cover application/backend processing time.

Answer C is incorrect because backend load can affect application time regardless of subnet.

Answer D is incorrect because network jitter metrics do not measure server CPU.

 

Question 13

A critical IP SLA probe targets one test responder. The responder process crashes, but the production application path beyond that router remains healthy. Monitoring raises an outage. What is the correct interpretation?

1. The application must also be down because the probe is down.
2. The probe result proves packet loss on every WAN link.
3. IP SLA responders cannot fail independently.
4. Validate the probe target before changing the network path.
5. The router should withdraw every production route automatically.

Correct Answer: D

 

Correct Answer

Answer D is correct because synthetic tests can fail because the measurement endpoint fails.

Incorrect Answers

Answer A is incorrect because the stem states production remains healthy. It does not satisfy the stem’s governing point: Measurement endpoints are part of the monitoring system and can create false network alarms when they fail independently.

Answer B is incorrect because the evidence does not localize loss and may be entirely endpoint-related.

Answer C is incorrect because the responder is a service/component and can be a measurement failure point.

Answer E is incorrect because an unvalidated probe failure should not imply all production paths are invalid.

 

Question 14

An IP SLA operation suddenly reports high latency. Before increasing alert thresholds, what should the engineer verify first when the probe uses a specified source interface?

7. That the syslog facility is local7.
8. That every switch uses the same STP priority.
9. Verify the intended source path and route.
10. That the HSRP group number matches the IP SLA operation number.
11. That the collector uses port 2055.

Correct Answer: C

 

Correct Answer

Answer C is correct because a changed or impaired measurement path can alter results and must be validated before masking the symptom.

Incorrect Answers

Answer A is incorrect because facility choice does not determine measured path latency.

Answer B is incorrect because spanning-tree priority is not the first prerequisite for an IP-routed probe path.

Answer D is incorrect because there is no such required relationship. It does not satisfy the stem’s governing point: Validate the measurement source/path and target before changing thresholds in response to unexpected synthetic results.

Answer E is incorrect because that is a common NetFlow export port, unrelated to IP SLA latency.

 

Question 15

A tracked static route is removed when `track 10` goes down. `track 10` references IP SLA 10. Which component actually decides whether the static route stays installed?

1. The remote IP SLA responder.
2. The tracking object/policy that maps the IP SLA result into an up/down state used by the route.
3. The NetFlow monitor.
4. The IP SLA operation directly edits the routing table.
5. The syslog server.

Correct Answer: B

 

Correct Answer

Answer B is correct because tracking provides the policy linkage between measurement state and routing action.

Incorrect Answers

Answer A is incorrect because the responder participates in measurement but does not control the local route configuration.

Answer C is incorrect because flow telemetry is independent of object tracking. It does not satisfy the stem’s governing point: Separate measurement from policy: IP SLA produces observations; object tracking and routing configuration act on them.

Answer D is incorrect because IP SLA generates measurement results; the tracking/routing configuration consumes them.

Answer E is incorrect because logging does not install/remove the route. It does not satisfy the stem’s governing point: Separate measurement from policy: IP SLA produces observations; object tracking and routing configuration act on them.

 

Question 16

A new Catalyst switch is reachable by management IP but does not appear in Catalyst Center Inventory. The team has not run Discovery for its range or seed. What should be done first?

1. Configure the switch as an HSRP standby.
2. Start an ERSPAN session from the switch to Catalyst Center.
3. Run Discovery with suitable credentials to add the device to Inventory.
4. Increase IP SLA timeout.
5. Create an AI anomaly baseline for the unknown device.

Correct Answer: C

 

Correct Answer

Answer C is correct because Discovery scans devices and feeds successfully discovered devices into Inventory.

Incorrect Answers

Answer A is incorrect because gateway role does not add it to Catalyst Center.

Answer B is incorrect because packet mirroring is not the inventory onboarding workflow.

Answer D is incorrect because IP SLA is unrelated to Catalyst Center Discovery.

Answer E is incorrect because assurance analytics require the device to be onboarded/observed first.

 

Question 17

Fifty access switches require the same approved NTP and logging configuration, but their interface numbering varies by device. Which Catalyst Center capability best supports repeatable deployment with controlled variables?

1. Use a reusable configuration template tied to the appropriate profile and site.
2. AI Network Analytics baseline.
3. RSPAN.
4. Manually paste different CLI text into every device and avoid templates.
5. Client Health dashboard.

Correct Answer: A

 

Correct Answer

Answer A is correct because templates centralize repeatable configuration intent while allowing variables for device-specific values.

Incorrect Answers

Answer B is incorrect because analytics detect anomalies rather than serve as a configuration template.

Answer C is incorrect because traffic mirroring is unrelated to configuration deployment. It does not satisfy the stem’s governing point: Use Catalyst Center templates/profiles for consistent, repeatable configuration intent across managed devices.

Answer D is incorrect because that increases inconsistency and misses the stated centralized automation goal.

Answer E is incorrect because health dashboards observe state rather than deploy the intended NTP/logging configuration.

 

Question 18

Users at one site complain about onboarding failures. The engineer wants a Catalyst Center view that summarizes affected clients, health and related issues before opening individual device CLIs. Which workflow is most appropriate?

1. Use only Design templates because templates display live client health.
2. Use Assurance health and issue views to isolate affected clients and symptoms.
3. Delete and rediscover the entire site.
4. Create an RSPAN VLAN across the enterprise first.
5. Run `show ip route` on every switch before checking centralized evidence.

Correct Answer: B

 

Correct Answer

Answer B is correct because Assurance is intended to provide health visibility and troubleshooting context across clients/devices/sites.

Incorrect Answers

Answer A is incorrect because templates define/deploy configuration; they are not the primary health dashboard.

Answer C is incorrect because that is disruptive and not justified as a first step.

Answer D is incorrect because packet capture can be useful later but is not the least disruptive first centralized view.

Answer E is incorrect because that discards the available assurance workflow and may be unnecessarily broad.

 

Question 19

A template specifies the intended AAA server on 100 switches. Assurance shows five devices are not behaving as expected. Why should the engineer compare deployed/intended configuration with observed device state rather than assume the template guarantees compliance?

1. AAA configuration cannot be templated.
2. Assurance always rewrites noncompliant configuration automatically.
3. Templates never deploy configuration.
4. Only syslog can detect any configuration drift.
5. A design/template expresses intent, while deployment failures, later changes or unsupported state can leave actual devices different; observed state must be verified.

Correct Answer: E

 

Correct Answer

Answer E is correct because intent and actual operational state are distinct and require compliance/verification evidence.

Incorrect Answers

Answer A is incorrect because templates can include many configuration elements; the premise is valid.

Answer B is incorrect because monitoring/issue visibility does not imply unconditional automatic correction.

Answer C is incorrect because templates can be used for provisioning; the issue is that intent does not guarantee current operational state.

Answer D is incorrect because Catalyst Center provides inventory/configuration/assurance mechanisms beyond syslog alone.

 

Question 20

Catalyst Center Inventory contains a switch, but its assurance health remains unknown because the credentials/telemetry prerequisites needed for ongoing collection are incomplete. Which principle applies?

1. RSPAN should replace all Catalyst Center telemetry.
2. Any device in Inventory automatically has complete client telemetry.
3. The switch must be removed from Inventory permanently.
4. Health is unknown only when STP is disabled.
5. Inventory presence alone does not guarantee meaningful Assurance data; required reachability, credentials and telemetry/collection must also function.

Correct Answer: E

 

Correct Answer

Answer E is correct because Assurance depends on data collection after discovery/inventory. This directly matches the stem’s governing point: Catalyst Center Assurance quality depends on successful telemetry/data collection, not merely an inventory record.

Incorrect Answers

Answer A is incorrect because packet mirroring is not a substitute for the management/assurance integration.

Answer B is incorrect because support and collection prerequisites vary and can fail.

Answer C is incorrect because the appropriate action is to correct prerequisites rather than necessarily remove the device.

Answer D is incorrect because many management/telemetry issues can prevent health data. It does not satisfy the stem’s governing point: Catalyst Center Assurance quality depends on successful telemetry/data collection, not merely an inventory record.

 

Question 21

Catalyst AI Network Analytics flags an unusual rise in DHCP onboarding time at one site relative to its learned baseline. Several other sites remain normal. What is the best use of this result?

1. Ignore the result because ML can never contribute troubleshooting evidence.
2. Change the baseline until the alert disappears.
3. Treat the anomaly score as proof that the DHCP server is defective.
4. Use the anomaly to prioritize investigation at the affected site and inspect supporting DHCP/client/network evidence.
5. Immediately replace every access switch at the site.

Correct Answer: D

 

Correct Answer

Answer D is correct because the baseline deviation is a useful prioritization signal but still needs evidence-based diagnosis.

Incorrect Answers

Answer A is incorrect because AI-driven issues are intended to highlight deviations and correlated evidence.

Answer B is incorrect because masking the deviation before validating it defeats the diagnostic purpose.

Answer C is incorrect because an anomaly indicates unusual behavior, not necessarily a single established cause.

Answer E is incorrect because that action is disproportionate without localization. It does not satisfy the stem’s governing point: AI-driven anomalies are useful to prioritize investigation and focus evidence collection, not to skip validation.

 

Question 22

Assurance correlates a high authentication-failure KPI, several client events and an upstream RADIUS timeout, then suggests the RADIUS path as a likely root cause. What is the most defensible interpretation?

1. An authentication issue cannot have a network-path cause.
2. The only safe action is to reboot the RADIUS server.
3. The correlation mathematically proves the RADIUS server caused every client failure.
4. Client events should be ignored because AI is always more authoritative.
5. The correlated evidence raises the RADIUS path as a strong hypothesis, but the engineer should validate reachability/service evidence before making a change.

Correct Answer: E

 

Correct Answer

Answer E is correct because correlation and guided root-cause analysis improve prioritization without making every suggestion infallible.

Incorrect Answers

Answer A is incorrect because timeouts can result from service or reachability/path problems.

Answer B is incorrect because a disruptive change is not justified before validation.

Answer C is incorrect because correlation and machine reasoning do not eliminate the need for validation.

Answer D is incorrect because underlying events are part of the evidence and should be considered.

 

Question 23

A site normally has DHCP onboarding times around 500 ms. AI Network Analytics begins flagging 1.8-second times as anomalous even though a static enterprise-wide alert threshold is 2 seconds. Why can that happen?

1. All AI issues ignore historical behavior.
2. AI anomaly detection can compare current behavior with a learned deployment-specific baseline rather than only a fixed global threshold.
3. The 2-second threshold is automatically deleted whenever AI is enabled.
4. The product interprets milliseconds as seconds.
5. DHCP timing is always identical across sites.

Correct Answer: B

 

Correct Answer

Answer B is correct because a deviation from predicted normal behavior can be significant before a static threshold is crossed.

Incorrect Answers

Answer A is incorrect because baseline learning is explicitly part of anomaly detection.

Answer C is incorrect because threshold-based and AI-driven issue mechanisms can coexist. It does not satisfy the stem’s governing point: AI Network Analytics can detect deviations from learned network-specific baselines even when a fixed threshold has not been crossed.

Answer D is incorrect because no unit error is required to explain the baseline-based alert.

Answer E is incorrect because site/network conditions can differ, which is why deployment-specific baselines are useful.

 

Question 24

Catalyst Center suggests a configuration change after an AI-assisted troubleshooting workflow. The network is a regulated production environment with a change window and rollback requirements. What should the engineer do?

1. Disable assurance until the next maintenance window.
2. Replace the change window with the anomaly timestamp.
3. Apply the recommendation immediately because AI suggestions are preapproved changes.
4. Validate the recommendation against the observed evidence and local change policy, then execute through the approved change/rollback process if justified.
5. Ignore all AI recommendations in regulated networks.

Correct Answer: D

 

Correct Answer

Answer D is correct because AI assistance does not supersede operational governance or the need to validate the proposed fix.

Incorrect Answers

Answer A is incorrect because monitoring can remain valuable and need not be disabled.

Answer B is incorrect because diagnostic timing does not override governance requirements. It does not satisfy the stem’s governing point: AI-assisted recommendations should be validated and executed under normal technical and governance controls.

Answer C is incorrect because recommendations are not universal authorization to bypass change control.

Answer E is incorrect because they can still be useful evidence/input when validated under policy.

 

Question 25

Telemetry from several access switches is missing during a suspected issue. AI Network Analytics shows no anomaly, but users and traditional interface counters show intermittent loss. What is the best next step?

1. Disable all switch ports until telemetry returns.
2. Increase the AI confidence score manually.
3. Conclude the user reports are false because AI found nothing.
4. Delete the interface counters because they conflict with AI.
5. Use traditional device/path verification and repair telemetry collection; absence of an AI issue is weak evidence when the input data is incomplete.

Correct Answer: E

 

Correct Answer

Answer E is correct because analytics depend on collected data, so missing telemetry limits what the model can observe.

Incorrect Answers

Answer A is incorrect because that is unnecessarily disruptive and unrelated to restoring evidence collection.

Answer B is incorrect because confidence cannot substitute for absent telemetry evidence. It does not satisfy the stem’s governing point: When analytics telemetry is incomplete, fall back to direct/traditional verification and restore data collection before treating analytics silence as evidence.

Answer C is incorrect because missing inputs can prevent anomaly detection. It does not satisfy the stem’s governing point: When analytics telemetry is incomplete, fall back to direct/traditional verification and restore data collection before treating analytics silence as evidence.

Answer D is incorrect because traditional evidence remains important, especially when analytics inputs are incomplete.