Virtualization

A network engineer is troubleshooting a Cisco IOS-XE router that hosts multiple virtual routing and forwarding (VRF) instances. Users in VRF-A report they cannot reach a server in VRF-B. The engineer verifies that both VRFs have the correct routes and that the router has a route leaking configuration using route-target import/export. However, connectivity still fails. What is the most likely cause?

Question 3hardmulti select

Review the full routing breakdown →

A data center uses Cisco Nexus 9000 switches with VXLAN EVPN to provide network virtualization. The operations team notices that VLAN 100 (mapped to VNI 10100) is not reachable across the fabric, although other VLANs work fine. The NVE interface is up, and the EVPN address-family is configured. Which two actions should the engineer take to isolate the issue?

Question 4mediummultiple choice

A network engineer is deploying a Cisco Catalyst 9300 switch as a virtual switch using StackWise Virtual. The switch will connect to two upstream routers for redundancy. What is the best practice for connecting the uplinks?

Question 5easymultiple choice

An enterprise uses VMware vSphere to host multiple virtual machines (VMs). The network team wants to implement a virtual firewall on the hypervisor to inspect traffic between VMs on the same ESXi host. Which technology should be used?

Question 6mediummultiple choice

A network engineer configured three interfaces on a switch as shown. A host connected to Ethernet1/2 sends an untagged frame. Which VLAN will this frame be placed into when it reaches Ethernet1/3?

Exhibit

Refer to the exhibit.

interface Ethernet1/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999
 no shutdown
!
interface Ethernet1/2
 switchport mode access
 switchport access vlan 10
 no shutdown
!
interface Ethernet1/3
 switchport mode trunk
 switchport trunk allowed vlan 20,30
 switchport trunk native vlan 1
 no shutdown

Question 7hardmultiple choice

A financial company runs a critical trading application in a virtualized environment on VMware vSphere. The application consists of two VMs: App-1 (web server) and App-2 (database server). Both VMs are on the same ESXi host. Recently, users report intermittent slowness during peak trading hours. Monitoring shows that App-1 experiences high CPU ready time (up to 15%) and App-2 has high disk latency (average 50 ms). The ESXi host has 16 vCPUs total (2 sockets, 8 cores each) and 128 GB RAM. The host runs 10 VMs total. App-1 has 4 vCPUs and 16 GB RAM; App-2 has 8 vCPUs and 32 GB RAM. The storage is a shared NFS datastore connected via 1 Gbps Ethernet. The network is 10 Gbps. What is the MOST effective course of action to resolve the performance issues?

Question 8mediummatching

Match each network device to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Forwards packets between different networks

Forwards frames within the same network

Controls traffic based on security policies

Manages access points centrally

Distributes traffic across multiple servers

Question 9mediummultiple choice

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint (VTEP) in a spine-leaf fabric. The engineer wants to verify that the NVE interface is operational and that the switch has learned remote VTEP IP addresses before deploying production traffic. Which command should the engineer use to display the NVE interface status and the remote VTEP peer information?

Question 10mediummultiple choice

A network engineer is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The engineer wants to ensure that the guest VRF can reach the internet via a default route, while the corporate VRF uses a different default route. Which command must be used to associate an interface with the guest VRF?

Question 11hardmultiple choice

An engineer is configuring a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The design requires that broadcast, unknown unicast, and multicast (BUM) traffic be replicated only to leaf switches that have active local members in the corresponding VNI, rather than flooding to every VTEP in the fabric. Which mechanism should the engineer configure to meet this requirement?

Question 12easymultiple choice

A network administrator is configuring a Cisco Nexus 9000 switch to support VXLAN. The administrator wants to verify that the NVE interface is operational and that the VXLAN tunnel endpoints are up. Which command should be used to display the status of the NVE interface and its VNIs?

Question 13hardmultiple choice

A network administrator is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance named CUSTOMER_A. The administrator wants to ensure that routes from the global routing table are not leaked into the VRF and that the VRF has its own separate routing table. Which configuration step is required to achieve this isolation?

Question 14hardmultiple choice

A network engineer is configuring a VRF-aware IPsec tunnel on a Cisco IOS-XE router. The router has two VRFs: VRF-A and VRF-B. The engineer wants to ensure that traffic from VRF-A is encrypted and sent over the tunnel, while traffic from VRF-B is sent unencrypted. Which configuration step is necessary to achieve this?

Question 15easymultiple choice

A network administrator is configuring a Cisco Nexus 9000 leaf switch to participate in a VXLAN EVPN fabric. The administrator wants the switch to originate Type-2 and Type-3 EVPN routes for locally attached hosts and VTEPs. Which command must be configured under the EVPN address family to enable this functionality?

Question 16mediummultiple choice

A network engineer is configuring VXLAN on a Cisco Nexus 9000 switch. The goal is to manually create a VXLAN tunnel interface that uses the primary loopback interface as the source and maps VLAN 100 to VNI 10100. Which set of commands is required to accomplish this?

Question 17easymultiple choice

A network administrator is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The administrator wants to ensure that traffic from the guest VRF cannot leak into the corporate VRF. Which feature should be configured to isolate the VRFs?

Question 18hardmulti select

A network architect is designing a Cisco ACI fabric for a multi-tenant data center. The architect needs to ensure that tenant traffic is isolated and that Layer 2 and Layer 3 forwarding are properly configured. Which two components are used to define the forwarding behavior and isolation in Cisco ACI? (Choose two.)

Question 19mediummultiple choice

A network administrator is configuring a new Cisco Catalyst 9300 switch stack to support a VMware vSphere environment. The administrator wants to enable jumbo frames for iSCSI storage traffic and ensure that the switch forwards frames up to 9216 bytes. Which command should be entered on the switch to achieve this?

Question 20hardmultiple choice

A network engineer is troubleshooting a VXLAN EVPN fabric on Cisco Nexus 9000 switches. Hosts in VLAN 100 on leaf1 cannot communicate with hosts in VLAN 100 on leaf2, even though both leaf switches have the same VNI configured and the underlay is operational. The engineer verifies that the EVPN Type 2 routes are present on both leaf switches. What is the most likely cause of the problem?

Question 21mediummulti select

A network engineer is designing a Cisco SD-Access fabric using VXLAN encapsulation. The engineer must ensure that the fabric supports both Layer 2 and Layer 3 overlay services. Which two components are required in the underlay network to support VXLAN? (Choose two.)

Question 22mediummulti select

A network engineer is configuring a Cisco IOS-XE router to support multiple virtual routing and forwarding (VRF) instances. The engineer needs to ensure that each VRF has its own routing table and that traffic from one VRF cannot leak into another. Which two statements are true about VRF configuration on Cisco IOS-XE? (Choose two.)

Question 23hardmultiple choice

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN tunnel endpoint (VTEP) in a VXLAN EVPN fabric. The engineer wants to ensure that the switch can forward traffic between VLANs that are mapped to different VNIs. Which configuration is required to enable inter-VNI routing on the VTEP?

Question 24mediummultiple choice

A network engineer is deploying a Cisco Nexus 9000 leaf-spine fabric with VXLAN EVPN. The design requires that any leaf switch be able to reach any other leaf switch's loopback with a single IGP hop, and that the underlay carry only routing information, not tenant MAC addresses. Which underlay routing approach satisfies this requirement with the least configuration and fastest convergence?

Question 25mediummulti select

A network engineer is deploying a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The design requires that broadcast, unknown unicast, and multicast (BUM) traffic be efficiently distributed across the fabric. Which two statements about the VXLAN data plane and BUM traffic handling are true? (Choose two.)

Question 26mediummulti select

A network engineer is deploying Cisco ACI in a data center. The engineer needs to integrate the ACI fabric with an external Layer 2 network to allow VLANs to be extended between the ACI fabric and the external network. Which two components are required to achieve this integration? (Choose two.)

Question 27hardmultiple choice

A network architect is designing a Cisco SD-Access fabric using LISP for control plane and VXLAN for data plane. The architect must ensure that endpoints in different virtual networks (VN) can communicate securely. Which component of the Cisco SD-Access architecture is responsible for enforcing security policies between VNs?

Question 28hardmulti select

Read the full wireless explanation →

A network engineer is designing a VXLAN EVPN fabric on Cisco Nexus 9000 switches and wants to reduce the amount of broadcast, unknown unicast, and multicast (BUM) flooding while still supporting multi-tenant segmentation. The engineer plans to use EVPN route types beyond Type 2. Which two EVPN route types provide the control-plane functions described? (Choose two.)

Question 29mediummulti select

A network engineer is deploying Cisco SD-Access and needs to configure the fabric to support wireless clients. The engineer must ensure that wireless traffic is properly encapsulated and forwarded within the fabric. Which two components are required to integrate wireless into the SD-Access fabric? (Choose two.)

Question 30mediummultiple choice

An organization wants to connect a branch office to a cloud-hosted virtual network using an overlay that provides Layer 2 extension while encrypting traffic over the public Internet. The design must not depend on any specific underlay transport and should allow endpoints to keep their existing IP addresses. Which approach best satisfies these requirements?

Question 31hardmultiple choice

Full Practice Test →All Objectives

An engineer configures a Cisco Catalyst 9000 switch with a VRF named MGMT and assigns the management interface to it. After the change, the engineer cannot reach the device from a TFTP server that resides in the global routing table, even though the physical path exists. Which action is required to restore management reachability?

More Virtualization questions available in the full practice test.

Continue Practising →

All 350-401 Objectives

Objective 200.010% of exam

Virtualization

350-401 Practice Questions

What this objective tests

350-401 Virtualization — Key Topics

Configure VRF-lite, VXLAN, and Cisco IOS XE guestshell to segment and virtualize control/data planes; the key is keeping VRF route leaking and VXLAN VNI-to-VLAN mappings correct.

Distinguishing Type 1 and Type 2 hypervisors and their Cisco deployment use cases
Configuring VRFs to isolate routing and forwarding tables on IOS XE devices
Describing VXLAN encapsulation, VTEP operation, and Layer 2 over Layer 3 extension
Using Cisco IOS XE guestshell and virtual routing to host services on one device

Common exam traps

Where candidates lose marks on Virtualization

⚠Treating VRF as a security feature; it separates routing tables but does not encrypt or firewall traffic by itself.
⚠Confusing VXLAN VNI mapping with VLAN ID mapping, assuming the two identifiers must always match.
⚠Assuming guestshell runs a full independent OS image rather than a Linux container inside IOS XE.

350-401 Virtualization — Practice Questions

30 questions from this objective · 10% of your 350-401 exam

Question 2mediummultiple choice

A network engineer is troubleshooting a Cisco IOS-XE router that hosts multiple virtual routing and forwarding (VRF) instances. Users in VRF-A report they cannot reach a server in VRF-B. The engineer verifies that both VRFs have the correct routes and that the router has a route leaking configuration using route-target import/export. However, connectivity still fails. What is the most likely cause?

Question 3hardmulti select

Review the full routing breakdown →

A data center uses Cisco Nexus 9000 switches with VXLAN EVPN to provide network virtualization. The operations team notices that VLAN 100 (mapped to VNI 10100) is not reachable across the fabric, although other VLANs work fine. The NVE interface is up, and the EVPN address-family is configured. Which two actions should the engineer take to isolate the issue?

Question 4mediummultiple choice

A network engineer is deploying a Cisco Catalyst 9300 switch as a virtual switch using StackWise Virtual. The switch will connect to two upstream routers for redundancy. What is the best practice for connecting the uplinks?

Question 5easymultiple choice

An enterprise uses VMware vSphere to host multiple virtual machines (VMs). The network team wants to implement a virtual firewall on the hypervisor to inspect traffic between VMs on the same ESXi host. Which technology should be used?

Question 6mediummultiple choice

A network engineer configured three interfaces on a switch as shown. A host connected to Ethernet1/2 sends an untagged frame. Which VLAN will this frame be placed into when it reaches Ethernet1/3?

Exhibit

Refer to the exhibit.

interface Ethernet1/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 switchport trunk native vlan 999
 no shutdown
!
interface Ethernet1/2
 switchport mode access
 switchport access vlan 10
 no shutdown
!
interface Ethernet1/3
 switchport mode trunk
 switchport trunk allowed vlan 20,30
 switchport trunk native vlan 1
 no shutdown

Question 7hardmultiple choice

A financial company runs a critical trading application in a virtualized environment on VMware vSphere. The application consists of two VMs: App-1 (web server) and App-2 (database server). Both VMs are on the same ESXi host. Recently, users report intermittent slowness during peak trading hours. Monitoring shows that App-1 experiences high CPU ready time (up to 15%) and App-2 has high disk latency (average 50 ms). The ESXi host has 16 vCPUs total (2 sockets, 8 cores each) and 128 GB RAM. The host runs 10 VMs total. App-1 has 4 vCPUs and 16 GB RAM; App-2 has 8 vCPUs and 32 GB RAM. The storage is a shared NFS datastore connected via 1 Gbps Ethernet. The network is 10 Gbps. What is the MOST effective course of action to resolve the performance issues?

Question 8mediummatching

Match each network device to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Forwards packets between different networks

Forwards frames within the same network

Controls traffic based on security policies

Manages access points centrally

Distributes traffic across multiple servers

Question 9mediummultiple choice

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint (VTEP) in a spine-leaf fabric. The engineer wants to verify that the NVE interface is operational and that the switch has learned remote VTEP IP addresses before deploying production traffic. Which command should the engineer use to display the NVE interface status and the remote VTEP peer information?

Question 10mediummultiple choice

A network engineer is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The engineer wants to ensure that the guest VRF can reach the internet via a default route, while the corporate VRF uses a different default route. Which command must be used to associate an interface with the guest VRF?

Question 11hardmultiple choice

An engineer is configuring a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The design requires that broadcast, unknown unicast, and multicast (BUM) traffic be replicated only to leaf switches that have active local members in the corresponding VNI, rather than flooding to every VTEP in the fabric. Which mechanism should the engineer configure to meet this requirement?

Question 12easymultiple choice

A network administrator is configuring a Cisco Nexus 9000 switch to support VXLAN. The administrator wants to verify that the NVE interface is operational and that the VXLAN tunnel endpoints are up. Which command should be used to display the status of the NVE interface and its VNIs?

Question 13hardmultiple choice

A network administrator is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance named CUSTOMER_A. The administrator wants to ensure that routes from the global routing table are not leaked into the VRF and that the VRF has its own separate routing table. Which configuration step is required to achieve this isolation?

Question 14hardmultiple choice

A network engineer is configuring a VRF-aware IPsec tunnel on a Cisco IOS-XE router. The router has two VRFs: VRF-A and VRF-B. The engineer wants to ensure that traffic from VRF-A is encrypted and sent over the tunnel, while traffic from VRF-B is sent unencrypted. Which configuration step is necessary to achieve this?

Question 15easymultiple choice

A network administrator is configuring a Cisco Nexus 9000 leaf switch to participate in a VXLAN EVPN fabric. The administrator wants the switch to originate Type-2 and Type-3 EVPN routes for locally attached hosts and VTEPs. Which command must be configured under the EVPN address family to enable this functionality?

Question 16mediummultiple choice

A network engineer is configuring VXLAN on a Cisco Nexus 9000 switch. The goal is to manually create a VXLAN tunnel interface that uses the primary loopback interface as the source and maps VLAN 100 to VNI 10100. Which set of commands is required to accomplish this?

Question 17easymultiple choice

A network administrator is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The administrator wants to ensure that traffic from the guest VRF cannot leak into the corporate VRF. Which feature should be configured to isolate the VRFs?

Question 18hardmulti select

A network architect is designing a Cisco ACI fabric for a multi-tenant data center. The architect needs to ensure that tenant traffic is isolated and that Layer 2 and Layer 3 forwarding are properly configured. Which two components are used to define the forwarding behavior and isolation in Cisco ACI? (Choose two.)

Question 19mediummultiple choice

A network administrator is configuring a new Cisco Catalyst 9300 switch stack to support a VMware vSphere environment. The administrator wants to enable jumbo frames for iSCSI storage traffic and ensure that the switch forwards frames up to 9216 bytes. Which command should be entered on the switch to achieve this?

Question 20hardmultiple choice

A network engineer is troubleshooting a VXLAN EVPN fabric on Cisco Nexus 9000 switches. Hosts in VLAN 100 on leaf1 cannot communicate with hosts in VLAN 100 on leaf2, even though both leaf switches have the same VNI configured and the underlay is operational. The engineer verifies that the EVPN Type 2 routes are present on both leaf switches. What is the most likely cause of the problem?

Question 21mediummulti select

A network engineer is designing a Cisco SD-Access fabric using VXLAN encapsulation. The engineer must ensure that the fabric supports both Layer 2 and Layer 3 overlay services. Which two components are required in the underlay network to support VXLAN? (Choose two.)

Question 22mediummulti select

A network engineer is configuring a Cisco IOS-XE router to support multiple virtual routing and forwarding (VRF) instances. The engineer needs to ensure that each VRF has its own routing table and that traffic from one VRF cannot leak into another. Which two statements are true about VRF configuration on Cisco IOS-XE? (Choose two.)

Question 23hardmultiple choice

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN tunnel endpoint (VTEP) in a VXLAN EVPN fabric. The engineer wants to ensure that the switch can forward traffic between VLANs that are mapped to different VNIs. Which configuration is required to enable inter-VNI routing on the VTEP?

Question 24mediummultiple choice

A network engineer is deploying a Cisco Nexus 9000 leaf-spine fabric with VXLAN EVPN. The design requires that any leaf switch be able to reach any other leaf switch's loopback with a single IGP hop, and that the underlay carry only routing information, not tenant MAC addresses. Which underlay routing approach satisfies this requirement with the least configuration and fastest convergence?

Question 25mediummulti select

A network engineer is deploying a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The design requires that broadcast, unknown unicast, and multicast (BUM) traffic be efficiently distributed across the fabric. Which two statements about the VXLAN data plane and BUM traffic handling are true? (Choose two.)

Question 26mediummulti select

A network engineer is deploying Cisco ACI in a data center. The engineer needs to integrate the ACI fabric with an external Layer 2 network to allow VLANs to be extended between the ACI fabric and the external network. Which two components are required to achieve this integration? (Choose two.)

Question 27hardmultiple choice

A network architect is designing a Cisco SD-Access fabric using LISP for control plane and VXLAN for data plane. The architect must ensure that endpoints in different virtual networks (VN) can communicate securely. Which component of the Cisco SD-Access architecture is responsible for enforcing security policies between VNs?

Question 28hardmulti select

Read the full wireless explanation →

A network engineer is designing a VXLAN EVPN fabric on Cisco Nexus 9000 switches and wants to reduce the amount of broadcast, unknown unicast, and multicast (BUM) flooding while still supporting multi-tenant segmentation. The engineer plans to use EVPN route types beyond Type 2. Which two EVPN route types provide the control-plane functions described? (Choose two.)

Question 29mediummulti select

A network engineer is deploying Cisco SD-Access and needs to configure the fabric to support wireless clients. The engineer must ensure that wireless traffic is properly encapsulated and forwarded within the fabric. Which two components are required to integrate wireless into the SD-Access fabric? (Choose two.)

Question 30mediummultiple choice

An organization wants to connect a branch office to a cloud-hosted virtual network using an overlay that provides Layer 2 extension while encrypting traffic over the public Internet. The design must not depend on any specific underlay transport and should allow endpoints to keep their existing IP addresses. Which approach best satisfies these requirements?

Question 31hardmultiple choice