CCNP Virtualization Practice Test 7 — 15 Questions

Question 1

A network engineer is designing a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The engineer must choose a multicast mode for BUM (Broadcast, Unknown unicast, Multicast) traffic replication. Which two statements are true regarding the use of multicast in a VXLAN EVPN fabric? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Each VNI is typically mapped to a unique multicast group address.. In a VXLAN EVPN fabric using multicast for BUM traffic, the underlay must support multicast routing, typically PIM SM with an RP. Each VNI is mapped to a unique multicast group address, and VTEPs join the group for their VNIs. This allows BUM traffic to be replicated to all VTEPs in the VNI. BGP EVPN is still used for control plane learning.

Answer

Ingress replication is required when using multicast mode.

Answer

Multicast mode eliminates the need for BGP EVPN for control plane learning.

Answer

Multicast mode requires a separate multicast group for each VTEP.

Question 2

A network engineer is deploying Cisco ACI in a data center. The engineer needs to configure a bridge domain that allows traffic to be routed between two EPGs that are in different subnets. Which ACI object must be configured to enable inter-subnet routing within the bridge domain?

Accepted Answer

Bridge domain with unicast routing enabled and subnets configured. Inter-subnet routing in Cisco ACI is enabled by configuring a bridge domain with unicast routing turned on and defining the necessary subnets. This allows the fabric to act as the default gateway for endpoints in those subnets and route traffic between them, even if they are in different EPGs.

Answer

Subnet under the bridge domain with a scope of 'Advertised Externally'

Answer

VRF

Answer

Contract

Question 3

A network engineer configured a Cisco IOS-XE router with VRF CUSTOMER_A and assigned Gi0/0/1 to it. The interface is up and has an IP address, but traffic sourced from the VRF cannot reach a remote prefix that is present in the global routing table. The engineer confirms the global route exists and the next hop is reachable. What is the most likely cause?

Accepted Answer

The VRF has no route to the destination and requires route leaking or a default route. VRFs create fully isolated routing and forwarding tables on the same physical router. A prefix installed in the global table is not automatically available inside a VRF, and vice versa. To allow the VRF to reach that destination, the engineer must either redistribute or leak the route between the global table and the VRF, or install a default route inside the VRF.

Answer

The interface must be configured with the ip vrf forwarding command a second time

Answer

The global routing table entry is a recursive route that cannot be resolved

Answer

CEF is disabled on the router, forcing all traffic to be process-switched

Question 4

A network administrator is configuring a Cisco CSR 1000v router in a virtualized environment. The administrator needs to ensure that the virtual router can forward traffic between virtual machines on different VLANs. Which feature must be enabled on the CSR 1000v to support this?

Accepted Answer

IP routing. To forward traffic between different VLANs, a Cisco CSR 1000v must have IP routing enabled. This allows the router to route packets between subnets configured on different interfaces or subinterfaces. Without IP routing, the router will not forward traffic between VLANs, regardless of other features.

Answer

VRF Lite

Answer

IPsec VPN

Answer

NAT

Question 5

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint (VTEP) in a spine-leaf fabric. The engineer needs to verify that the NVE interface is operational and that the VNI-to-VLAN mapping is correct. Which command should the engineer use to display the VXLAN tunnel endpoints and their associated VNIs?

Accepted Answer

show nve vni. The engineer needs to verify both the NVE interface operational status and the VNI-to-VLAN mapping. The 'show nve vni' command provides a comprehensive view of the VNIs, their associated VLANs, and the state of each VNI, which directly addresses the requirement. Other commands show partial information, such as peers or interface details, but do not combine the mapping and operational status in one output.

Answer

show nve interface nve1

Answer

show nve peers

Answer

show vxlan vni

Question 6

A network administrator is deploying a virtual switch on a Cisco UCS B-Series blade server. The administrator wants the virtual switch to be managed by Cisco UCS Manager and to support Cisco VM-FEX so that virtual machine traffic is visible to the upstream fabric interconnects. Which virtual switch technology meets these requirements?

Accepted Answer

Cisco Virtual Machine Fabric Extender in UCS Manager. VM-FEX integrated with Cisco UCS Manager is the virtual switching technology that lets the fabric interconnect manage virtual interfaces and expose virtual machine traffic to upstream ports. It is administered from UCS Manager, which the administrator requires. Nexus 1000V, vSphere Standard Switch, and Open vSwitch do not provide UCS Manager-managed VM-FEX capability in this scenario.

Answer

Cisco Nexus 1000V Virtual Supervisor Module

Answer

VMware vSphere Standard Switch

Answer

Open vSwitch with Cisco ACI integration

Question 7

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN tunnel endpoint. The engineer needs to define the source IP address used for the VXLAN tunnels and ensure the switch can replicate broadcast, unknown unicast, and multicast traffic. Which configuration element must be created to source the tunnels?

Accepted Answer

A loopback interface with an IP address that is used as the NVE source in the interface nve1 configuration.. On a Cisco Nexus 9000, the NVE interface is used to define VXLAN tunnel endpoints, and it must reference a source interface, typically a loopback with a stable IP address. That loopback address becomes the VTEP address that remote switches use to build tunnels. The other options describe unrelated interface types or encapsulations that do not fulfill the VXLAN tunnel source requirement.

Answer

A subinterface on the uplink port configured with encapsulation dot1q and used as the NVE source.

Answer

A tunnel interface configured with tunnel mode gre and the underlay destination as the source.

Answer

A VLAN interface with the same IP address as the underlay physical interface to act as the tunnel source.

Question 8

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The design requires that all VTEPs in the fabric learn the IP addresses of remote VTEPs so that BUM traffic can be replicated using ingress replication. Which control-plane component is responsible for distributing this VTEP IP address information across the fabric?

Accepted Answer

The EVPN Type-3 route carrying the VTEP loopback address and VNI membership. Ingress replication requires each VTEP to know the loopback IP address of every other VTEP participating in the same VNI. EVPN Type-3 Inclusive Multicast Ethernet Tag routes serve precisely this purpose, advertising the originating VTEP IP, VNI, and Ethernet tag. Type-2 handles host MAC/IP bindings, Type-5 handles IP prefix advertisement, and PIM belongs to multicast replication designs.

Answer

The PIM Anycast-RP configuration on the spine switches

Answer

The EVPN Type-5 route carrying IP prefix reachability for the tenant VRF

Answer

The EVPN Type-2 route carrying MAC and IP address bindings for host endpoints

Question 9

A network engineer is deploying Cisco ACI in a data center. The requirement is to allow an external Layer 3 router to dynamically learn the endpoints that reside in a specific bridge domain (BD) and to advertise the BD's subnet to the external network. The external router is connected to a border leaf switch. Which Cisco ACI construct must be configured to meet this requirement?

Accepted Answer

An L3Out with an external EPG and OSPF or BGP peering to the external router.. The L3Out construct in Cisco ACI is designed for external Layer 3 connectivity. It includes an external EPG and supports routing protocols such as OSPF, BGP, or EIGRP. By configuring an L3Out on the border leaf, the fabric can peer with the external router, advertise the bridge domain subnet, and learn external routes. Contracts are for policy, not route exchange, and static path bindings are for Layer 2 connectivity.

Answer

A VRF with a contract that permits all traffic between the external router and the BD.

Answer

A bridge domain with unicast routing enabled and a contract to the external EPG.

Answer

An EPG with a static path binding to the external router's interface.

Question 10

A network engineer is troubleshooting a Cisco IOS-XE router that hosts several virtual routing and forwarding instances. A route to 10.20.30.0/24 exists in both the global routing table and in VRF CUSTOMER_A. A packet arrives on an interface assigned to VRF CUSTOMER_A with destination 10.20.30.10. How does the router determine which routing table to consult?

Accepted Answer

It uses the VRF forwarding table associated with the ingress interface's VRF.. The VRF used for a forwarding lookup is determined by the VRF membership of the ingress interface, not by the destination address. Once the interface's VRF is identified, the router performs a longest prefix match inside that VRF's forwarding table, which keeps overlapping tenant and global addressing independent and isolated.

Answer

It always consults the global routing table first and falls back to the VRF table only if no match is found.

Answer

It uses the destination address to choose the VRF whose route has the longest prefix match.

Answer

It compares administrative distance between the global and VRF entries and selects the lower value.

Question 11

A network administrator is deploying Cisco Application Centric Infrastructure (ACI) and needs to allow two endpoint groups (EPGs) in different bridge domains to communicate while applying a contract that permits only TCP port 443. Which ACI construct provides the policy enforcement point where the contract is applied?

Accepted Answer

The policy enforcement point on the leaf where the EPGs reside. ACI applies contracts at the leaf switch, which acts as the policy enforcement point for the attached EPGs. The APIC distributes the compiled policy, but the leaf hardware renders and enforces the permit for TCP port 443 between the two EPGs in their respective bridge domains.

Answer

The VXLAN tunnel interface on the spine

Answer

The bridge domain subnet SVI on the border leaf

Answer

The APIC controller cluster policy compiler

Question 12

A network administrator is configuring a Cisco IOS-XE router to support Virtual Routing and Forwarding (VRF). The administrator wants to ensure that traffic from different VRFs can be routed between each other using a shared service VRF. Which VRF feature allows routes to be leaked between VRFs?

Accepted Answer

Route target export and import. Route targets are used to control the import and export of routes between VRFs. By configuring matching route targets on two VRFs, routes can be leaked from one VRF to another. This is the standard method for inter-VRF communication in MPLS L3VPN and VRF-lite environments. Route distinguishers make prefixes unique but do not control leaking.

Answer

VRF forwarding table

Answer

IP routing protocol redistribution

Answer

Route distinguisher

Question 13

A data center team is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches and wants to eliminate the need for multicast underlay replication for broadcast, unknown unicast, and multicast traffic. Which mechanism should the team implement to achieve ingress replication of BUM traffic?

Accepted Answer

Enable head-end replication using EVPN Type 3 routes. With EVPN, Type 3 Inclusive Multicast Ethernet Tag routes advertise each VTEP's interest in a VNI, allowing ingress leaf switches to construct a list of remote VTEPs per VNI. BUM frames are then replicated by the ingress VTEP directly to each remote VTEP, which is head-end replication and removes the need for a multicast-capable underlay.

Answer

Configure PIM sparse mode on all underlay interfaces

Answer

Enable IGMP snooping on all leaf access ports

Answer

Configure MSDP peering between all leaf switches

Question 14

A network engineer is deploying a Cisco SD-Access fabric. The design requires that endpoints in the same virtual network can communicate with each other even when they attach to different fabric edge nodes, while endpoints in different virtual networks remain isolated. Which control-plane component is responsible for registering endpoint IP-to-location mappings and answering fabric edge node queries?

Accepted Answer

Fabric control-plane node. In Cisco SD-Access, the fabric control-plane node provides the LISP-based mapping database that stores endpoint ID-to-RLOC associations. Edge nodes register local endpoints and query this node to learn where remote endpoints reside, which enables communication between endpoints in the same virtual network across different edge nodes while preserving isolation between virtual networks.

Answer

Fabric intermediate node

Answer

Cisco DNA Center appliance

Answer

Fabric edge node

Question 15

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured for VXLAN EVPN. The engineer notices that the switch is not learning remote MAC addresses from other VTEPs. The underlay routing is working, and MP-BGP EVPN peering is established. Which configuration issue could prevent the switch from learning remote MAC addresses?

Accepted Answer

The VNI is not mapped to the correct VLAN in the EVPN configuration.. In VXLAN EVPN, the VNI must be mapped to the correct VLAN for the switch to associate EVPN routes with local VLANs and learn remote MAC addresses. If the mapping is missing or incorrect, the switch cannot install remote MACs into the MAC address table, even if EVPN peering is up and the underlay is functional.

Answer

The BGP router ID is not unique.

Answer

The underlay OSPF cost is too high.

Answer

The switch is configured with a static VXLAN tunnel instead of a dynamic one.