350-401 Network Function Virtualization Practice Questions

Question 1

A company is migrating its legacy firewall services to a virtualized environment using Cisco NFV. The network engineer deploys a virtual firewall (vFW) on an NFVIS-enabled UCS platform. After the deployment, traffic through the vFW is intermittent and performance monitoring shows high CPU usage on the host. Which action should the engineer take to improve performance?

Accepted Answer

Enable SR-IOV on the physical NICs and assign VFs to the vFW.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch and reducing CPU overhead for packet processing. In an NFVIS environment, high host CPU usage with intermittent traffic indicates that the vFW is consuming excessive CPU cycles due to software-based I/O. Assigning VFs to the vFW offloads packet handling to the NIC hardware, lowering host CPU utilization and stabilizing traffic.

Answer

Increase the number of vCPUs allocated to the vFW VM.

Answer

Configure QoS policies on the vFW to prioritize traffic.

Answer

Disable hyperthreading on the host CPU.

Question 2

An enterprise is deploying a virtual router (vRouter) as part of its NFV infrastructure. The engineer needs to ensure that the vRouter can handle a sudden spike in traffic without dropping packets. The vRouter is running on a KVM hypervisor. What should the engineer configure to guarantee CPU resources for the vRouter during peak demand?

Accepted Answer

Configure CPU pinning and CPU reservation for the vRouter VM.. CPU pinning binds the vRouter's virtual CPUs to specific physical cores, preventing other processes from using them, while CPU reservation guarantees a minimum amount of CPU capacity. Together, they ensure deterministic CPU availability during traffic spikes, preventing packet drops due to resource contention on the KVM hypervisor.

Answer

Enable memory ballooning on the vRouter VM.

Answer

Enable DPDK on the vRouter's virtual NICs.

Answer

Set the vRouter VM to use NUMA node pinning.

Question 3

A network engineer is deploying a virtual WAN edge device using Cisco SD-WAN on an NFVIS platform. After powering on the VM, the device fails to boot and the NFVIS console shows 'ERROR: No bootable device found'. The engineer verified that the ISO image is correctly uploaded. What is the most likely cause?

Accepted Answer

The boot order in the VM configuration does not have the CD-ROM (ISO) as the first device.. Option C is correct because the error 'No bootable device found' indicates that the VM attempted to boot from a device that does not contain a bootable operating system. In NFVIS, when deploying a virtual WAN edge device from an ISO, the VM's boot order must be configured to prioritize the CD-ROM (ISO) device. If the boot order defaults to the virtual hard disk (which is empty before installation), the VM will fail to find a bootable medium and produce this exact error.

Answer

The VM's virtual disk size is too small for the WAN edge image.

Answer

The VM's CPU type is set to 'host-passthrough' instead of 'qemu64'.

Answer

The ISO image is corrupted and NFVIS cannot read it.

Question 4

An engineer is managing a Cisco NFVIS host running multiple virtual network functions (VNFs). The engineer needs to upgrade the NFVIS software to a new version that includes critical security patches. The upgrade process must minimize downtime. Which upgrade method should the engineer use?

Accepted Answer

Use the 'software install add' command to stage the image, then 'activate' and 'commit' with a single reboot.. Option B is correct because the 'software install add' command stages the new NFVIS image, followed by 'activate' and 'commit' with a single reboot, which minimizes downtime by performing the upgrade in a single reboot cycle. This method is the recommended approach for upgrading NFVIS while preserving existing VNF configurations and minimizing service disruption.

Answer

Use the 'patch install' command to apply the upgrade without rebooting.

Answer

Perform a clean installation of the new NFVIS version and redeploy all VNFs.

Answer

Migrate all VNFs to another NFVIS host, then upgrade the original host.

Question 5

A company uses Cisco NFVIS to host a virtual ASA (vASA) and a virtual router (vRouter). The engineer notices that the vASA cannot communicate with the vRouter even though both are on the same NFVIS host. The vASA is connected to a bridge network, and the vRouter is connected to a different bridge. What should the engineer do to enable communication between the two VNFs?

Accepted Answer

Create a new bridge that connects both VNFs, or use a virtual switch to route between the bridges.. In NFVIS, VNFs attached to different bridge networks are isolated at Layer 2. To enable communication between them, you must either create a new bridge that connects both VNFs or use a virtual switch (e.g., a Linux bridge with routing enabled) to forward traffic between the two bridges. This allows the VNFs to share a common Layer 2 domain or have a routed path through the hypervisor.

Answer

Connect a physical cable between two ports on the NFVIS host.

Answer

Configure VLAN tagging on both VNFs with the same VLAN ID.

Answer

Add a static route on each VNF pointing to the other VNF's IP address.

Question 6

An engineer is deploying a virtual network function (VNF) on a Cisco NFVIS host. The VNF requires four virtual NICs, each connected to a different network segment. The engineer creates four bridges on NFVIS and attaches each vNIC to a separate bridge. After deployment, the VNF can only communicate on the first bridge. What is the most likely cause?

Accepted Answer

The bridges are all mapped to the same physical interface without subinterfaces, causing a conflict.. In Cisco NFVIS, bridges are Layer 2 forwarding constructs that must be mapped to a physical interface (or subinterface) to provide external connectivity. When multiple bridges are all mapped to the same physical interface without using subinterfaces (e.g., GigabitEthernet0/0), they share the same VLAN and MAC domain, causing traffic from the second, third, and fourth bridges to be dropped or misdirected. The VNF can only communicate on the first bridge because that bridge's vNIC is the only one that successfully establishes a valid forwarding path through the physical interface.

Answer

The VNF's operating system does not support multiple NICs.

Answer

The vNICs have duplicate MAC addresses.

Answer

The bridges were created in the wrong order.

Question 7

A network engineer is troubleshooting a performance issue with a virtual firewall (vFW) running on a Cisco NFVIS host. The vFW is experiencing high packet loss during peak traffic. The engineer checks the NFVIS monitoring dashboard and sees that the vFW's CPU usage is low, but the host's memory usage is high. What is the most likely cause of the packet loss?

Accepted Answer

The host is under memory pressure, causing the hypervisor to swap or balloon memory from the vFW.. When the NFVIS host experiences high memory pressure, the hypervisor may reclaim memory from virtual machines (VMs) using mechanisms such as ballooning or swapping. This reduces the memory available to the vFW, causing it to drop packets because its packet buffers or operating system memory are forcibly reclaimed. The vFW's CPU remains low because the bottleneck is memory, not processing power.

Answer

The vFW is CPU-bound, but the monitoring is inaccurate.

Answer

The host's CPU is oversubscribed, causing vCPU starvation.

Answer

The vFW's packet buffer is exhausted, but the monitoring does not show it.

Question 8

An engineer is deploying a virtual router (vRouter) on a Cisco NFVIS host. The vRouter needs to advertise routes to a physical router connected to the host's management port. The engineer configures the vRouter with an IP address on the same subnet as the management port. However, the physical router does not receive any routing updates. What should the engineer do to enable route exchange?

Accepted Answer

Connect the vRouter to a data plane interface (e.g., a bridge connected to a physical data port) instead of the management port.. Option D is correct because in Cisco NFVIS, the management port is isolated from the data plane and is intended only for out-of-band management traffic. Routing protocols like OSPF or BGP cannot exchange routes over the management interface because it lacks the necessary data-plane forwarding capabilities. To advertise routes to a physical router, the vRouter must be connected to a data plane interface, such as a bridge mapped to a physical data port, which supports routing protocol adjacency and packet forwarding.

Answer

Configure a static route on the vRouter pointing to the physical router.

Answer

Enable OSPF on the vRouter's management interface.

Answer

Change the management port to a trunk port to carry routing updates.

Question 9

A company is deploying a virtual WAN optimizer (vWAAS) on a Cisco NFVIS host. The engineer needs to ensure that the vWAAS can intercept traffic between two VNFs running on the same host. The traffic currently flows directly between the VNFs without passing through the vWAAS. What should the engineer configure to redirect the traffic?

Accepted Answer

Create a service chain in NFVIS that places the vWAAS between the two VNFs.. Option A is correct because NFVIS supports service chaining, which allows an administrator to define a sequence of VNFs that traffic must traverse. By creating a service chain that places the vWAAS between the two VNFs, NFVIS will automatically redirect the traffic through the vWAAS using internal bridging or vSwitch forwarding rules, without requiring any configuration changes on the VNFs themselves.

Answer

Configure a static route on each VNF pointing to the vWAAS.

Answer

Enable WCCP on the vWAAS and configure the VNFs to use WCCP.

Answer

Use policy-based routing on the VNFs to forward traffic to the vWAAS.

Question 10

A company is deploying a virtualized network function (VNF) on a KVM-based host. The VNF requires dedicated CPU cores and must avoid performance interference from other VMs. Which hypervisor configuration best meets these requirements?

Accepted Answer

Configure CPU pinning and use dedicated NUMA nodes.. Option B is correct because CPU pinning binds the VNF's vCPUs to specific physical cores, ensuring dedicated CPU resources and preventing interference from other VMs. Using dedicated NUMA nodes further optimizes memory locality, reducing latency and avoiding cross-NUMA memory access, which is critical for performance-sensitive VNFs.

Answer

Enable CPU overcommitment and use a single NUMA node.

Answer

Use VMware vSphere with DRS set to Aggressive.

Answer

Deploy the VNF as a container instead of a VM.

Network Function Virtualization