Please take a look at this one.  You have the correct explanation for the question but appear to have accidentally selected the incorrect answer(it has the tunnel using its own address as the source).

Questions don't match to the answers in this Drag & Drop.
Please correct as soon as possible.

The VRRP Virtual IP mis-match, the answer of Priority 120 only then can be right once the V - IP is corrected.

Just took the test. Failed. Been at this for months on H2P.

Many of the multi choice questions were spot on. Only had a few which looked new.

6 sims right up front.

Take this as you will, but this is how I see it. The correct answer  is "Modify the source through the 'ip flow-export source loopback 1' command", as indicated for the reasons below.

A. Wrong, Loopback 2 already has an address as shown in the output, 172.16.1.1
B. Wrong, Does not need to be public address unless leaving your AS.
C. Correct, Loopback 2 is shutdown as indicated the (Unknown) next to the source ip under “show ip flow export”.  Assuming that Loopback 1 is not shutdown and has an IP address then C is the correct answer.
D. Exports happen even without the ip flow egress command on the loopback

We're using DNA Center so obviously we're managing more than just the device "WLC-5520".  If ntp was wrong on the DNA Center then we'd be receiving errors from more than just the one WLC.  The question states "NTP is configured across the network infrastructure and Cisco DNA Center" so "Check and configure NTP on the WLC..." isn't the answer.  Observe the first suggested action in the exhibit:

 "1 If NTP is enabled, check whether the NTP server are reachable from the DNA Center and the WLC."

Thus, the foregone conclusion is that the correct answer is "check and resolve reachability between the WLC and the NTP server".

Thanks again for your consideration.

BTW, I tried to post a clearer image of the exhibit but I don't have a site to host the image.

The correct answer should be "IPv6 Prefix Guard".

IPv6 Prefix Guard is used on ingress interfaces to deny access to traffic that has a correct address but that is not topologically correct. The feature discovers ranges of addresses that have been assigned to a link and blocks any traffic sourced with an address outside that range, ensuring that traffic is sourced from its assigned location.

https://www.cisco.com/c/en/us/td/docs/sw...%20command.

https://www.cisco.com/c/en/us/td/docs/io...20gleaning.

This question is testing our knowledge of regular expressions. 

The correct list of distractors are:

- Replace as-path access-list 1 with the ip as-path access-list 1 permit ^300$ command  <---correct answer
- Replace as-path access-list 1 with the ip as-path access-list 1 permit _300_ command
- Replace as-path access-list 1 with the ip as-path access-list 1 permit ^300_ command
- Replace as-path access-list 1 with the ip as-path access-list 1 permit ^300_ command

The ^300$ regular expression ensures that the route’s AS-PATH begins and ends with 300, meaning the route originated from AS300.

I finally passed the Encore exam Friday. Most of the questions was spot on, although about 10 of the questions I had never seen. All of the labs were spot on. There should be no issue passing if you hone in and the questions and build all of the labs. I would suggest using Cisco Modeling Labs since it is free now. Good Luck!

The ip tacacs source-interface should be Gi0/0 and not Gi0/1 because as indicated in the diagram, the tacacs server is hanging off of Gi0/0.  And of course we should have "ip vrf forwarding CompanyA".