CCNP Virtualization Practice Test 2 — 15 Questions

Question 1

A network administrator is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The administrator wants to ensure that traffic from the guest VRF cannot leak into the corporate VRF. Which feature should be configured to isolate the VRFs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VRF isolation is inherent; no additional feature is needed. VRF instances are inherently isolated. Once interfaces are assigned to a VRF, traffic is confined to that VRF's routing table. No additional feature is needed to prevent leakage; in fact, leaking requires explicit configuration. The administrator should ensure that no route leaking or VRF-aware NAT is configured, and that interfaces are correctly assigned. This isolation is a fundamental property of VRFs and is why they are used for segmentation.

Answer

VRF-lite

Answer

VRF-aware NAT

Answer

VRF leaking

Question 2

A network architect is designing a Cisco ACI fabric for a multi-tenant data center. The architect needs to ensure that tenant traffic is isolated and that Layer 2 and Layer 3 forwarding are properly configured. Which two components are used to define the forwarding behavior and isolation in Cisco ACI? (Choose two.)

Accepted Answer

Endpoint Group (EPG). In Cisco ACI, Bridge Domains (BDs) define Layer 2 forwarding and can include Layer 3 gateway subnets, while Endpoint Groups (EPGs) group endpoints with similar policies and are associated with BDs. Together, they provide tenant isolation and control forwarding behavior. VRFs provide Layer 3 isolation but are not the primary components for forwarding behavior definition.

Answer

Application Network Profile (ANP)

Answer

VXLAN Network Identifier (VNI)

Answer

Virtual Routing and Forwarding (VRF)

Question 3

A network administrator is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The administrator wants to ensure that traffic from the guest VRF cannot leak into the corporate VRF. Which feature should be configured to isolate the VRFs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

system mtu jumbo 9216. To enable jumbo frames on a Cisco Catalyst switch for iSCSI storage traffic, the correct command is 'system mtu jumbo 9216'. This sets the jumbo MTU globally for ports that support it, allowing frames up to 9216 bytes. A reload is required for the change to take effect. The other commands either set the system MTU for standard frames, configure IP MTU on routed interfaces, or are not applicable to Layer 2 switching.

Answer

system mtu 9216

Answer

mtu 9216

Answer

ip mtu 9216

Question 4

A network engineer is troubleshooting a VXLAN EVPN fabric on Cisco Nexus 9000 switches. Hosts in VLAN 100 on leaf1 cannot communicate with hosts in VLAN 100 on leaf2, even though both leaf switches have the same VNI configured and the underlay is operational. The engineer verifies that the EVPN Type 2 routes are present on both leaf switches. What is the most likely cause of the problem?

Accepted Answer

The VLAN-to-VNI mapping is inconsistent between leaf1 and leaf2.. The most likely cause is an inconsistent VLAN-to-VNI mapping between leaf switches. For hosts in the same VLAN to communicate over VXLAN, the VLAN must be mapped to the same VNI on all VTEPs. If the mapping differs, the VXLAN encapsulation uses different VNIs, and the receiving VTEP cannot correctly decapsulate and forward traffic to the intended VLAN.

Answer

The underlay routing protocol is not advertising the loopback interfaces.

Answer

The BGP EVPN peering is down between the leaf switches.

Answer

The VXLAN UDP port is blocked by an ACL on the underlay.

Question 5

A network engineer is designing a Cisco SD-Access fabric using VXLAN encapsulation. The engineer must ensure that the fabric supports both Layer 2 and Layer 3 overlay services. Which two components are required in the underlay network to support VXLAN? (Choose two.)

Accepted Answer

A loopback interface on each VTEP for the VXLAN source address. VXLAN requires an IP underlay with reachability between VTEPs, typically provided by an IGP such as OSPF or IS-IS. Each VTEP needs a stable source address, usually a loopback interface, which is advertised into the underlay. These two components ensure that VXLAN tunnels can be established and that overlay traffic can be forwarded. Multicast, MPLS, and out-of-band management are not mandatory for VXLAN.

Answer

MPLS LDP in the underlay for label switching

Answer

A dedicated out-of-band management network for all switches

Answer

A multicast-enabled core for BUM traffic replication

Question 6

A network engineer is configuring a Cisco IOS-XE router to support multiple virtual routing and forwarding (VRF) instances. The engineer needs to ensure that each VRF has its own routing table and that traffic from one VRF cannot leak into another. Which two statements are true about VRF configuration on Cisco IOS-XE? (Choose two.)

Accepted Answer

The ip vrf forwarding command on an interface removes any existing IP address configuration.. Two correct statements about VRF configuration on Cisco IOS-XE are that each VRF has its own CEF table and interfaces must be assigned to a VRF, and that applying ip vrf forwarding removes existing IP addresses. These behaviors are critical when designing isolated routing instances and require careful reconfiguration of IP addressing after VRF assignment.

Answer

A single VRF can be assigned to multiple interfaces, but each interface can belong to only one VRF.

Answer

Route targets are required for local VRF operation on a single router.

Answer

VRF-aware services such as SNMP and syslog automatically use the management VRF without additional configuration.

Question 7

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN tunnel endpoint (VTEP) in a VXLAN EVPN fabric. The engineer wants to ensure that the switch can forward traffic between VLANs that are mapped to different VNIs. Which configuration is required to enable inter-VNI routing on the VTEP?

Accepted Answer

Enable IP routing and configure an SVI for each VLAN, then use EVPN to advertise the MAC/IP routes.. To enable inter-VNI routing on a VXLAN EVPN VTEP, you must configure SVIs for each VLAN with IP addresses and enable EVPN to advertise MAC/IP routes. This allows the VTEP to perform symmetric IRB, routing traffic between different VNIs. Without SVIs and EVPN MAC/IP advertisements, the VTEP can only bridge within a VNI, not route between them.

Answer

Enable VXLAN routing by using anycast gateway on the VTEPs and advertise the anycast MAC via EVPN.

Answer

Configure VXLAN tunnels between all VTEPs and enable proxy ARP on the SVIs.

Answer

Configure a VRF for each VNI and enable route leaking between the VRFs.

Question 8

A network engineer is deploying a Cisco Nexus 9000 leaf-spine fabric with VXLAN EVPN. The design requires that any leaf switch be able to reach any other leaf switch's loopback with a single IGP hop, and that the underlay carry only routing information, not tenant MAC addresses. Which underlay routing approach satisfies this requirement with the least configuration and fastest convergence?

Accepted Answer

Configure eBGP on each leaf, peering with every spine, and advertise each leaf's loopback as a /32 into the underlay.. A VXLAN EVPN leaf-spine underlay must provide loopback-to-loopback reachability with a single routing hop, which is achieved by having every leaf peer with every spine and advertise its loopback as a /32. eBGP on each leaf-spine link fits this model directly, keeping the underlay purely IP and leaving MAC and IP tenant reachability to the EVPN overlay. Other approaches either do not enforce the two-tier peering model or confuse underlay routing with overlay tunnel termination.

Answer

Configure OSPFv2 on all leaf and spine interfaces, advertising each leaf's loopback with a /32 into the underlay area.

Answer

Configure VXLAN tunnel endpoints on the spines so that leaf loopbacks are reachable through the overlay, and run no routing protocol in the underlay.

Answer

Configure eBGP on each leaf, peering with every spine, and advertise each leaf's loopback as a /32 with the spine acting as a route reflector.

Question 9

A network engineer is deploying a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The design requires that broadcast, unknown unicast, and multicast (BUM) traffic be efficiently distributed across the fabric. Which two statements about the VXLAN data plane and BUM traffic handling are true? (Choose two.)

Accepted Answer

The VXLAN header includes a 24-bit VNID and an 8-bit flags field.. VXLAN uses a 24-bit VNID, enabling about 16 million segments, and its header contains an 8-bit flags field and a 24-bit VNID. These are fundamental data plane characteristics. BUM traffic handling can use ingress replication or multicast, so claiming it is always head-end replication is false. VTEPs do not require identical VNIDs, and the encapsulation description must include the VXLAN header.

Answer

VXLAN encapsulation adds a UDP header, an outer IP header, and an outer Ethernet header.

Answer

BUM traffic is always replicated using head-end replication in EVPN fabrics.

Answer

VTEPs must be configured with the same VNID on all switches to allow communication.

Question 10

A network engineer is deploying Cisco ACI in a data center. The engineer needs to integrate the ACI fabric with an external Layer 2 network to allow VLANs to be extended between the ACI fabric and the external network. Which two components are required to achieve this integration? (Choose two.)

Accepted Answer

A Layer 2 Outside (L2Out) configuration.. To integrate Cisco ACI with an external Layer 2 network, you must configure a Layer 2 Outside (L2Out) and an external bridged domain. The L2Out defines the external connection, while the external bridged domain maps the internal VLANs to the external VLANs. Together, they allow VLANs to be stretched between the ACI fabric and the external network. Other components like L3Out or VXLAN are used for different purposes.

Answer

A Layer 3 Outside (L3Out) configuration.

Answer

An ACI tenant with a VRF and bridge domain.

Answer

A VXLAN tunnel profile.

Question 11

A network architect is designing a Cisco SD-Access fabric using LISP for control plane and VXLAN for data plane. The architect must ensure that endpoints in different virtual networks (VN) can communicate securely. Which component of the Cisco SD-Access architecture is responsible for enforcing security policies between VNs?

Accepted Answer

Fabric border node. In Cisco SD-Access, fabric border nodes serve as the gateway between the fabric and external networks, as well as between different virtual networks. They enforce security policies by applying group-based policies using SGTs and contracts. When traffic from one VN needs to reach another, it is routed through the border node, which inspects and enforces the policy. Thus, the border node is the correct component responsible for inter-VN security enforcement.

Answer

Fabric intermediate node

Answer

Fabric edge node

Answer

Fabric control plane node

Question 12

A network engineer is designing a VXLAN EVPN fabric on Cisco Nexus 9000 switches and wants to reduce the amount of broadcast, unknown unicast, and multicast (BUM) flooding while still supporting multi-tenant segmentation. The engineer plans to use EVPN route types beyond Type 2. Which two EVPN route types provide the control-plane functions described? (Choose two.)

Accepted Answer

Type 3 Inclusive Multicast Ethernet Tag routes, which advertise VTEP membership so BUM traffic is replicated only to participating VTEPs. Type 3 Inclusive Multicast Ethernet Tag routes build the per-VNI replication list so BUM traffic reaches only participating VTEPs, directly reducing flooding. Type 5 IP Prefix routes advertise tenant subnet prefixes and are imported by route target into the correct VRF, supporting multi-tenant Layer 3 segmentation. Type 1, Type 4, and Type 6 routes serve multihoming and multicast membership functions rather than these two control-plane roles.

Answer

Type 1 Ethernet Auto-Discovery routes, which advertise Ethernet Segment identifiers for fast convergence

Answer

Type 4 Ethernet Segment routes, which designate the DF and BDF roles for multihomed access

Answer

Type 6 Selective Multicast Ethernet Tag routes, which advertise multicast group membership

Question 13

A network engineer is deploying Cisco SD-Access and needs to configure the fabric to support wireless clients. The engineer must ensure that wireless traffic is properly encapsulated and forwarded within the fabric. Which two components are required to integrate wireless into the SD-Access fabric? (Choose two.)

Accepted Answer

Fabric-enabled access points. To integrate wireless into Cisco SD-Access, you need a fabric-enabled WLC and fabric-enabled APs. The WLC registers wireless clients with the fabric control plane and handles VXLAN encapsulation, while the APs provide the wireless access and encapsulate traffic. Other fabric nodes like edge, border, and control plane are part of the overall fabric but are not specific to wireless integration.

Answer

Fabric edge node

Answer

Fabric control plane node

Answer

Fabric border node

Question 14

An organization wants to connect a branch office to a cloud-hosted virtual network using an overlay that provides Layer 2 extension while encrypting traffic over the public Internet. The design must not depend on any specific underlay transport and should allow endpoints to keep their existing IP addresses. Which approach best satisfies these requirements?

Accepted Answer

Deploy VXLAN with a Layer 3 underlay and enable MACsec on the physical uplinks.. VXLAN builds a Layer 2 overlay over any IP-routable underlay, which preserves endpoint addressing and removes dependency on a specific transport, while MACsec supplies link-level encryption on the physical connections. The other choices either operate only at Layer 3, omit encryption, or require a direct Layer 2 path that does not exist across the Internet.

Answer

Implement 802.1Q trunking between the branch switch and the cloud provider's virtual switch.

Answer

Configure OSPF area 0 between the branch and the cloud provider's edge routers.

Answer

Use a GRE tunnel without IPsec between the branch router and the cloud gateway.

Question 15

An engineer configures a Cisco Catalyst 9000 switch with a VRF named MGMT and assigns the management interface to it. After the change, the engineer cannot reach the device from a TFTP server that resides in the global routing table, even though the physical path exists. Which action is required to restore management reachability?

Accepted Answer

Configure a route leak using ip route vrf MGMT with the global keyword to import the server prefix into the MGMT VRF. VRFs create separate routing and forwarding tables, so an interface inside MGMT cannot reach prefixes that exist only in the global table. Using the global keyword on a static route inside the VRF imports the global prefix into that VRF, restoring reachability. The other choices either remove the VRF design, misplace the server, or introduce an MPLS architecture that the scenario does not require.

Answer

Configure ip vrf forwarding MGMT on the TFTP server's connected interface

Answer

Enable MPLS L3VPN on the switch and redistribute the global table into the MGMT VRF

Answer

Remove the VRF from the management interface and use a management VRF only for logging