Practice 350-401 VRF and Path Isolation questions with full explanations on every answer.
Start practicing
VRF and Path Isolation — choose a session length
Free · No account required
Click any question to see the full explanation and answer options, or start a focused practice session above.
A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE PE router. The engineer creates a VRF named CUSTOMER_A with route-target import and export 100:1. After configuring the VRF on the interface connected to the CE router, the CE router can ping the PE's VRF interface IP, but cannot reach any remote VPNv4 routes. The BGP session between PE and route reflector is up. What is the most likely cause?
2An enterprise uses VRF-lite to isolate guest Wi-Fi traffic from corporate traffic on a Cisco Catalyst 9300 switch. The guest VRF (GUEST) is configured on VLAN 100, and the corporate VRF (CORP) on VLAN 200. Both VRFs use the same default gateway router connected via a trunk. The engineer notices that guest devices can reach the internet but cannot access the guest captive portal hosted on a server in VLAN 100. The server's IP is reachable from the switch itself. What is the issue?
3A service provider uses MPLS L3VPN with multiple VRFs on a Cisco ASR 1000 PE router. One customer VRF (RED) has overlapping IP addresses with another VRF (BLUE). The engineer configures route-target import/export as 100:1 for RED and 200:2 for BLUE. Both VRFs have a static default route pointing to the CE. The PE receives VPNv4 routes from the route reflector for both VRFs. However, traffic from RED to its CE is working, but traffic from BLUE to its CE is intermittently failing. What is the most likely cause?
4A network engineer is troubleshooting a VRF-lite deployment on a Cisco Nexus 9000 switch. Two VRFs, PROD and DEV, are configured. The switch has an SVI for VLAN 10 in VRF PROD and VLAN 20 in VRF DEV. A firewall is connected to a Layer 3 port in VRF PROD for internet access. The engineer needs to allow the DEV VRF to reach the internet through the same firewall, but without using a separate physical interface. What should the engineer configure?
5An engineer is configuring MPLS L3VPN on a Cisco IOS-XR router. The VRF CUSTOMER_B is configured with route-target import 100:1 and export 100:1. The engineer notices that the VRF routes are not being advertised to the route reflector. The BGP session to the route reflector is established and the VPNv4 address family is activated. What is the missing configuration?
6A company uses VRF-lite to separate management traffic (VRF MGMT) from user traffic (VRF USER) on a Cisco Catalyst 3850 stack. The management network is 10.0.0.0/24, and the user network is 192.168.1.0/24. The engineer wants to allow SSH access from the user network to the management network for device administration. The switch has an SVI for each VRF. What is the simplest way to achieve this while maintaining VRF isolation?
7A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE router. The VRF CUSTOMER_C has route-target import 300:1 and export 300:1. The PE receives VPNv4 routes from the route reflector, but the CE router connected to the PE cannot ping any remote site IP addresses. The PE can ping the remote site IP addresses from the VRF. What is the most likely cause?
8An enterprise uses VRF-lite on a Cisco Catalyst 9300 to isolate a guest network (VRF GUEST) from the corporate network (VRF CORP). The guest network uses DHCP from a server in the corporate network. The engineer configures a DHCP relay on the guest SVI pointing to the corporate DHCP server. The DHCP server is in VRF CORP. The guest clients are not receiving IP addresses. What is the issue?
9A service provider is migrating a customer from a global routing table to a VRF on a Cisco ASR 1000. The customer has a BGP session with the provider for internet access. After moving the customer's interface to VRF CUSTOMER_D, the BGP session goes down. The engineer verifies that the VRF is configured with the correct route-target and that the BGP neighbor is configured under address-family ipv4 vrf CUSTOMER_D. What else is missing?
10A network engineer runs the following command on Router R1: R1# show ip route vrf CUSTOMER-A VRF CUSTOMER-A: Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route Gateway of last resort is 10.0.1.1 to network 0.0.0.0 10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks C 10.0.0.0/30 is directly connected, GigabitEthernet0/0.100 L 10.0.0.1/32 is directly connected, GigabitEthernet0/0.100 B 10.0.2.0/24 [200/0] via 192.168.1.2, 00:12:34 Based on this output, what can be concluded?
11A network engineer runs the following command on Router R2: R2# show vrf detail VRF CUSTOMER-B (VRF Id = 1); default RD 65000:1; default VPNID <not set> Interfaces: GigabitEthernet0/0.200 GigabitEthernet0/1.200 Address family IPV4 unicast: Export VPN route-target communities: RT:65000:100 Import VPN route-target communities: RT:65000:100 No export route-map No import route-map Address family IPV6 unicast: Export VPN route-target communities: RT:65000:100 Import VPN route-target communities: RT:65000:100 Members: 10.0.0.0/24 Based on this output, what can be concluded?
12A network engineer runs the following command on Router R3: R3# show bgp vpnv4 unicast all summary BGP router identifier 10.0.0.3, local AS number 65000 BGP table version is 10, main routing table version 10 10 network entries using 1440 bytes of memory 10 path entries using 1360 bytes of memory 6/5 BGP path/bestpath attribute entries using 840 bytes of memory 4 BGP AS-PATH entries using 112 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 3752 total bytes of memory BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.1 4 65000 1000 1000 10 0 0 01:23:45 5 192.168.2.2 4 65000 800 800 10 0 0 00:45:12 3 Based on this output, what can be concluded?
13A network engineer runs the following command on Router R4: R4# show mpls ldp neighbor vrf CUSTOMER-C Peer LDP Ident: 10.0.0.5:0; Local LDP Ident 10.0.0.4:0 TCP connection: 10.0.0.5.646 - 10.0.0.4.646 State: Oper; Msgs sent/rcvd: 500/500; Downstream Up time: 02:30:00 LDP discovery sources: GigabitEthernet0/0.300, Src IP addr: 10.0.1.2 hello sent/rcvd: 1000/1000 Addresses bound to peer LDP Ident: 10.0.1.2 10.0.2.2 Based on this output, what can be concluded?
14A network engineer runs the following command on Router R5: R5# show ip interface brief | include VRF Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0.100 10.0.0.1 YES NVRAM up up GigabitEthernet0/0.200 10.0.1.1 YES NVRAM up up GigabitEthernet0/0.300 10.0.2.1 YES NVRAM up up Loopback100 10.100.0.1 YES NVRAM up up R5# show vrf brief Name Default RD Protocols Interfaces CUSTOMER-A 65000:1 ipv4 Gi0/0.100 CUSTOMER-B 65000:2 ipv4 Gi0/0.200 CUSTOMER-C 65000:3 ipv4 Gi0/0.300 Based on this output, what can be concluded?
15A network engineer runs the following command on Router R6: R6# show ip route vrf CUSTOMER-D VRF CUSTOMER-D: 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.0.0.0/30 is directly connected, GigabitEthernet0/0.400 L 10.0.0.1/32 is directly connected, GigabitEthernet0/0.400 192.168.0.0/16 is variably subnetted, 1 subnets, 1 mask B 192.168.1.0/24 [200/0] via 10.0.0.2, 00:10:00 R6# show ip bgp vpnv4 vrf CUSTOMER-D BGP table version is 5, local router ID is 10.0.0.6 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 192.168.1.0/24 10.0.0.2 0 100 0 i Based on this output, what can be concluded?
16A network engineer runs the following command on Router R7: R7# show ip ospf neighbor vrf CUSTOMER-E Neighbor ID Pri State Dead Time Address Interface 10.0.0.8 1 FULL/DR 00:00:35 10.0.1.2 GigabitEthernet0/0.500 10.0.0.9 1 FULL/BDR 00:00:31 10.0.2.2 GigabitEthernet0/0.600 Based on this output, what can be concluded?
17A network engineer runs the following command on Router R8: R8# show ip pim neighbor vrf CUSTOMER-F Neighbor Interface Uptime/Expires Ver DR 10.0.3.2 GigabitEthernet0/0.700 02:00:00/00:01:30 v2 1/ DR 10.0.4.2 GigabitEthernet0/0.800 01:30:00/00:01:45 v2 0/ NDR (BDR) Based on this output, what can be concluded?
18A network engineer runs the following command on Router R9: R9# show policy-map interface GigabitEthernet0/0.900 GigabitEthernet0/0.900 Service-policy input: QOS_POLICY_VRF_G Class-map: CLASS_VOICE (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp ef (46) police: cir 1000000 bps, bc 31250 bytes, be 31250 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: CLASS_DATA (match-all) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: ip dscp af31 (26) police: cir 2000000 bps, bc 62500 bytes, be 62500 bytes conformed 0 packets, 0 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop violated 0 packets, 0 bytes; actions: drop Class-map: class-default (match-any) 0 packets, 0 bytes 5 minute offered rate 0 bps, drop rate 0 bps Match: any Based on this output, what can be concluded?
19Examine the following configuration snippet on a Cisco IOS-XE router: interface GigabitEthernet0/1 ip vrf forwarding BLUE ip address 192.168.1.1 255.255.255.0 no shutdown What is the effect of this configuration?
20Consider the following configuration on a Cisco IOS-XE router: vrf definition RED rd 100:1 route-target export 100:1 route-target import 100:1 ! interface GigabitEthernet0/2 vrf forwarding RED ip address 10.10.10.1 255.255.255.0 Which statement is true about this configuration?
21A network engineer configures VRF-lite on a router with the following snippet: vrf definition GREEN rd 200:1 ! interface GigabitEthernet0/3 vrf forwarding GREEN ip address 172.16.1.1 255.255.255.0 ! router ospf 10 vrf GREEN network 172.16.1.0 0.0.0.255 area 0 What is missing from this configuration to enable proper OSPF routing within VRF GREEN?
22Review the following configuration: vrf definition CUSTOMER_A rd 65000:100 route-target export 65000:100 route-target import 65000:100 ! interface GigabitEthernet0/4 vrf forwarding CUSTOMER_A ip address 192.168.100.1 255.255.255.0 ! router bgp 65000 address-family ipv4 vrf CUSTOMER_A redistribute connected What is the purpose of the 'redistribute connected' command under the VRF address-family?
23Examine the following VRF configuration: vrf definition BLUE rd 1:1 route-target export 1:1 route-target import 2:2 ! interface GigabitEthernet0/5 vrf forwarding BLUE ip address 10.0.0.1 255.255.255.0 What is the effect of having different export and import route targets?
24A router has the following configuration snippet: vrf definition RED rd 100:1 ! interface Loopback0 ip vrf forwarding RED ip address 10.0.0.1 255.255.255.255 ! router eigrp 100 address-family ipv4 unicast vrf RED autonomous-system 100 network 10.0.0.1 0.0.0.0 What is the issue with this EIGRP configuration for VRF RED?
25What is the default OSPF hello interval on an Ethernet link?
26Which BGP attribute is preferred when it has the lowest value?
27What is the maximum hop count for EIGRP?
28Drag and drop the steps of VRF-Lite inter-VRF route leaking configuration into the correct order, from first to last.
29Drag and drop the steps of MPLS Layer 3 VPN VRF configuration on a PE router into the correct order, from first to last.
30Drag and drop the steps of VRF-aware NAT configuration for path isolation into the correct order, from first to last.
31Drag and drop the steps of MP-BGP VPNv4 route advertisement between PE routers into the correct order, from first to last.
32Drag and drop the steps of MPLS L3VPN packet forwarding steps into the correct order, from first to last.
33Drag and drop the steps of VRF-aware NAT configuration steps into the correct order, from first to last.
34Drag and drop the steps of VRF import/export route-target policy flow into the correct order, from first to last.
35Drag and drop the steps of VRF selection using policy-based routing into the correct order, from first to last.
36Drag and drop the steps of MP-BGP VPNv4 route advertisement between PE routers into the correct order, from first to last.
37Drag and drop the steps of MPLS L3VPN packet forwarding steps into the correct order, from first to last.
38Drag and drop the steps of VRF-aware NAT configuration steps into the correct order, from first to last.
39Drag and drop the steps of VRF import/export route-target policy flow into the correct order, from first to last.
40Drag and drop the steps of VRF selection using policy-based routing into the correct order, from first to last.
41Drag and drop each VRF component on the left to its matching function on the right.
42Drag and drop each MPLS VPN role on the left to its matching description on the right.
43Drag and drop each route-target action on the left to its matching behavior on the right.
44Drag and drop each VRF-Lite or MPLS VPN characteristic on the left to its matching description on the right.
45Drag and drop each MP-BGP address family on the left to its matching use case on the right.
46Drag and drop each VRF component on the left to its matching function on the right.
47Drag and drop each MPLS VPN role on the left to its matching description on the right.
48Drag and drop each route-target action on the left to its matching behavior on the right.
49Drag and drop each VRF-Lite vs MPLS VPN characteristic on the left to its matching description on the right.
50Drag and drop each MP-BGP address family on the left to its matching use case on the right.
51Which two statements about VRF configuration in Cisco IOS-XE are true? (Choose two.)
52Which three statements about VRF-lite are true? (Choose three.)
53Which two statements about VRF route leaking are true? (Choose two.)
54Which three statements about VRF path isolation in a service provider network are true? (Choose three.)
55Which two statements about VRF-aware services are true? (Choose two.)
56Which three statements about VRF route targets are true? (Choose three.)
57Which two statements about VRF-lite configuration are true? (Choose two.)
58Which three statements about path isolation using VRF are true? (Choose three.)
The VRF and Path Isolation domain covers the key concepts tested in this area of the 350-401 exam blueprint published by Cisco. Courseiva provides free domain-focused practice, mock exams, missed-question review, and readiness tracking across all 350-401 domains — no account required.
The Courseiva 350-401 question bank contains 58 questions in the VRF and Path Isolation domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the VRF and Path Isolation domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included