350-601 Practice Test 45 — 15 Questions

Question 1

A network engineer is troubleshooting a VXLAN EVPN fabric where a leaf switch is not learning remote MAC addresses. The engineer verifies that the underlay OSPF adjacencies are up, BGP EVPN peering is established, and the NVE interface is up. The engineer suspects an issue with the EVPN route advertisement. Which command should be used to verify that the leaf switch is receiving Type-2 EVPN routes from remote VTEPs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show bgp l2vpn evpn route-type 2. To verify that Type-2 EVPN routes are being received, the engineer should use 'show bgp l2vpn evpn route-type 2'. This command filters the EVPN RIB to show only MAC/IP Advertisement routes. It provides details such as the MAC address, IP address, and next-hop VTEP. If routes are missing, the engineer can further investigate BGP EVPN peering or route filters.

Answer

show ip route ospf

Answer

show bgp l2vpn evpn summary

Answer

show nve peers

Question 2

An engineer is configuring a Cisco Nexus 9000 switch to participate in a VXLAN EVPN fabric. The underlay uses OSPF and the overlay uses iBGP with EVPN. The engineer notices that remote MAC addresses are not being learned. Which action should be taken to allow MAC address learning over the EVPN control plane?

Accepted Answer

Enable the EVPN address family under the BGP routing process and activate it toward the BGP EVPN peers.. In a VXLAN EVPN fabric, the BGP EVPN address family is responsible for exchanging MAC and IP reachability information between VTEPs. Even if the underlay and BGP peering are up, the EVPN address family must be enabled and activated for the peers. Without it, remote MAC addresses are not learned, and traffic relies on flooding. Enabling the address family and activating it toward the EVPN peers restores control-plane MAC learning.

Answer

Configure the NVE interface with a source-interface loopback and enable ingress replication for all BUM traffic.

Answer

Enable OSPF on the NVE interface and advertise the loopback address into OSPF.

Answer

Configure a route-map on the BGP peer to allow only IPv4 unicast routes and set the next-hop to the NVE loopback.

Question 3

A network engineer is troubleshooting a VXLAN EVPN fabric where a leaf switch is not learning remote MAC addresses. The engineer verifies that the underlay OSPF adjacencies are up, BGP EVPN peering is established, and the NVE interface is up. The engineer suspects an issue with the EVPN route advertisement. Which command should be used to verify that the leaf switch is receiving Type-2 EVPN routes from remote VTEPs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MAC addresses are advertised via BGP EVPN as Type-2 routes and can also be learned in the data plane.. In a VXLAN EVPN fabric, MAC addresses are distributed via BGP EVPN Type-2 routes, which contain the MAC, IP, VNI, and VTEP next-hop. This control-plane learning allows leaf switches to install MAC entries without data plane flooding. Data plane learning can also occur as a fallback, but the primary mechanism is control-plane. The issue described might be due to a failure in BGP EVPN route advertisement or programming, not necessarily data plane learning.

Answer

MAC addresses are learned only through the BGP EVPN control plane and never in the data plane.

Answer

MAC addresses are learned only in the data plane through VXLAN encapsulated traffic.

Answer

MAC addresses are learned by flooding unknown unicast traffic to all VTEPs, which then respond with their MAC tables.

Question 4

An engineer is configuring an ACI fabric and needs to allow traffic between two EPGs that reside in different tenants. The security policy requires that the communication be explicitly permitted and that the provider EPG expose only TCP port 443. Which ACI construct should the engineer configure?

Accepted Answer

A contract with a filter containing a TCP destination port 443 entry, exported and imported between the tenants.. Contracts in ACI define the rules for inter-EPG communication, and each contract contains subjects with filters that match specific protocols and ports. For cross-tenant communication, the contract must be exported from the provider tenant and imported into the consumer tenant so the consumer EPG can reference it. A filter matching TCP destination port 443 restricts the allowed traffic to HTTPS only.

Answer

A taboo contract applied to both EPGs to deny all traffic except port 443.

Answer

A VRF leak configured between the two tenants with an external EPG.

Answer

A bridge domain shared between the two tenants with a static path binding.

Question 5

An engineer is deploying a new Cisco Nexus 9000 switch in a data center and needs to configure the management interface. The switch will be managed out-of-band on a dedicated management VLAN. Which interface must be configured with an IP address to allow remote management access?

Accepted Answer

The mgmt0 interface. The mgmt0 interface is the dedicated out-of-band management port on Cisco Nexus switches. It is isolated from the data plane and is designed for management traffic. Configuring an IP address on mgmt0 allows remote access via SSH, SNMP, or other management protocols without affecting production traffic. Other interfaces like Ethernet ports or SVIs are used for in-band management and do not provide the same level of separation and security.

Answer

The Ethernet1/1 interface

Answer

The loopback0 interface

Answer

The Vlan1 interface

Question 6

A network engineer is configuring a Cisco Nexus 9000 switch running NX-OS 9.3 as a leaf in a VXLAN EVPN fabric. The engineer wants to implement a Layer 3 underlay using OSPF and needs to verify the OSPF neighbor adjacency with the spine switch. The engineer runs the command 'show ip ospf neighbors' but sees no neighbors listed. The physical interfaces are up and IP connectivity to the spine's loopback is confirmed. Which action should the engineer take to establish the OSPF adjacency?

Accepted Answer

Enable OSPF on the interfaces connecting to the spine using the 'ip router ospf 1 area 0' command under the interface configuration.. OSPF adjacencies on NX-OS require OSPF to be enabled on the participating interfaces. After configuring the OSPF process, the engineer must enable OSPF on each interface with the 'ip router ospf 1 area 0' command. Physical connectivity and IP reachability alone do not activate OSPF; the protocol must be explicitly enabled per interface. This is a common oversight when configuring OSPF on Nexus switches.

Answer

Configure the OSPF router ID manually using the 'router-id' command under the OSPF process.

Answer

Configure OSPF authentication on both the leaf and spine interfaces to match the authentication settings.

Answer

Change the OSPF network type on the interfaces to point-to-point using the 'ip ospf network point-to-point' command.

Question 7

A network engineer is designing a VXLAN EVPN fabric with Cisco Nexus 9000 switches. The engineer must choose a mechanism for BUM (Broadcast, Unknown Unicast, Multicast) traffic handling. Which two options are valid BUM traffic handling mechanisms in a VXLAN EVPN fabric? (Choose two.)

Accepted Answer

Multicast underlay using PIM-SM. In a VXLAN EVPN fabric, BUM traffic can be handled using ingress replication or multicast in the underlay. Ingress replication involves the ingress VTEP replicating packets to all remote VTEPs. Multicast underlay uses a multicast group per VNI, with PIM-SM in the underlay to replicate traffic efficiently. Both are valid and commonly deployed depending on scale and requirements.

Answer

Static VXLAN tunnels

Answer

BGP EVPN route reflectors

Answer

Anycast RP with MSDP

Question 8

An engineer is designing a Cisco ACI fabric. The requirement is to allow communication between an EPG in tenant A and an EPG in tenant B. The engineer needs to configure the appropriate construct to permit this traffic. Which ACI object should be used to define the rules that allow this communication?

Accepted Answer

Contract. In Cisco ACI, communication between EPGs is governed by contracts. A contract contains subjects and filters that define the allowed traffic. To enable communication between EPGs in different tenants, the contract must be configured appropriately, often using exported contracts or shared services. Bridge domains, VRFs, and filters are supporting objects but do not directly permit inter-EPG traffic.

Answer

VRF

Answer

Filter

Answer

Bridge Domain

Question 9

A network engineer is configuring an ACI fabric and needs to allow traffic between two EPGs that are in different VRFs. The engineer has already created a contract with the appropriate filters. What must be configured to enable communication between these EPGs?

Accepted Answer

Configure a shared L3Out or a VRF leak to allow route exchange between the VRFs.. In ACI, contracts define policy between EPGs, but they do not override VRF isolation. When EPGs are in different VRFs, you must provide routing between those VRFs. This can be done by configuring a shared L3Out that both VRFs use, or by configuring VRF route leaking to exchange routes. Once routing is established, the contract can be applied to allow the specific traffic. Without this routing, the contract will not enable communication.

Answer

Configure the contract as a provider and consumer on the respective EPGs.

Answer

Configure the EPGs in the same bridge domain and change the VRF.

Answer

Configure a taboo contract between the EPGs.

Question 10

An engineer is configuring an ACI fabric and needs to ensure that traffic between two EPGs is permitted. The engineer has created a contract with a filter that allows TCP port 443. Which two additional configurations are required to make the contract effective? (Choose two.)

Accepted Answer

Associate the contract as a provider to the EPG that offers the service.. In ACI, a contract defines the rules for communication between EPGs. For the contract to be effective, it must be provided by the EPG offering the service and consumed by the EPG accessing the service. These two associations create the relationship that allows the filter to be applied. Without both, the contract is not enforced, and traffic between the EPGs remains denied by the implicit deny rule.

Answer

Create a taboo contract to explicitly deny all other traffic between the EPGs.

Answer

Configure a service graph to insert a firewall between the EPGs.

Answer

Apply a contract interface to the spine switches to enforce the filter.

Question 11

A data center engineer is deploying a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The engineer wants to ensure that the fabric supports multitenancy with overlapping IP addresses across different tenants. The design uses a spine-leaf topology with BGP EVPN as the control plane. Which feature must be enabled on the leaf switches to allow overlapping IP addresses in different VRFs?

Accepted Answer

Virtual Routing and Forwarding (VRF) instances. To support overlapping IP addresses across tenants, the fabric must maintain separate routing tables per tenant. VRF instances provide this isolation on Nexus switches. In a VXLAN EVPN fabric, each VRF is mapped to a Layer 3 VNI and uses unique route distinguishers and route targets to exchange routes. While anycast gateway and BGP EVPN attributes are important, they depend on VRFs. Thus, VRFs are the fundamental feature enabling multitenancy with overlapping IPs.

Answer

VXLAN Network Identifier (VNI) to VLAN mapping

Answer

BGP EVPN route distinguishers (RDs) and route targets (RTs)

Answer

Anycast gateway with distributed IP routing

Question 12

An engineer is deploying a new Cisco Nexus 9000 leaf switch into an existing VXLAN EVPN fabric. The underlay uses OSPF area 0 and the overlay uses iBGP with the spines as route reflectors. After the leaf is racked and cabled, the engineer notices that no Type-2 or Type-5 routes are being received from the spines, even though the OSPF neighbor relationships are FULL. Which configuration step was most likely missed on the new leaf?

Accepted Answer

The leaf must be configured with the 'feature nv overlay' and 'nv overlay evpn' commands, and the BGP neighbor must be activated under the L2VPN EVPN address family.. In a VXLAN EVPN fabric, the underlay (OSPF) provides IP reachability between VTEPs, but the overlay control plane requires BGP EVPN. The L2VPN EVPN address family must be enabled and the BGP neighbor must be activated under that address family for the leaf to receive Type-2 (MAC/IP) and Type-5 (IP prefix) routes. Without it, the leaf only exchanges IPv4 unicast routes and cannot learn remote MAC addresses or prefixes.

Answer

The leaf must be configured with the 'system bridge-domain' and 'system nve infra-vlans' commands to enable VXLAN encapsulation.

Answer

The leaf must be configured with a static VXLAN tunnel endpoint (VTEP) mapping for each spine to establish the overlay.

Answer

The leaf must be configured with a unique OSPF router ID that is higher than all spine router IDs to become a designated router.

Question 13

An engineer is troubleshooting a VXLAN EVPN fabric on Cisco Nexus 9000 Series switches. The underlay uses OSPF, and the overlay uses iBGP with EVPN address family. Some leaf switches are not learning remote MAC addresses from other leaf switches, but they can ping the remote VTEP loopback addresses. Which action should the engineer take to resolve the issue?

Accepted Answer

Verify that the EVPN address family is activated under the BGP neighbor configuration on all spine switches.. In a VXLAN EVPN fabric using iBGP, the EVPN address family must be activated on the BGP sessions between leaf and spine switches. Spines often act as route reflectors, and if the EVPN address family is not enabled, EVPN routes are not exchanged, preventing leaf switches from learning remote MAC addresses. Underlay connectivity (OSPF) and VTEP reachability can still be functional, masking the control plane issue.

Answer

Ensure that the OSPF cost on the leaf uplinks is equal so that traffic is load-balanced across all spines.

Answer

Increase the MTU on all spine-leaf links to accommodate VXLAN encapsulation overhead.

Answer

Configure the NVE interface with a multicast group address to enable BUM traffic replication.

Question 14

An engineer is troubleshooting a VXLAN EVPN fabric where a leaf switch is not learning remote MAC addresses from another leaf. The engineer verifies that the underlay OSPF adjacencies are up and that the BGP EVPN session between the leaf and spine is established. Which command should the engineer use to verify that the local VTEP is correctly advertising its MAC addresses to the remote VTEP?

Accepted Answer

show bgp l2vpn evpn. The 'show bgp l2vpn evpn' command is the most direct way to verify BGP EVPN routes, including MAC address advertisements (Type 2) and IMET routes (Type 3). By checking this table, the engineer can see if the local VTEP is advertising its MAC addresses and if the remote VTEP's advertisements are present. This helps isolate whether the problem is with advertisement or reception.

Answer

show ip ospf neighbor

Answer

show nve peers

Answer

show mac address-table

Question 15

A network engineer is configuring a Cisco Nexus 9000 leaf switch running NX-OS in a VXLAN EVPN fabric. The engineer wants the switch to advertise and learn Layer 2 MAC addresses and Layer 3 host routes through the fabric's BGP control plane. Which BGP address family must be explicitly enabled under the neighbor configuration to accomplish this?

Accepted Answer

address-family l2vpn evpn. VXLAN EVPN relies on the L2VPN EVPN NLRI to distribute MAC and IP reachability between VTEPs. Enabling the EVPN address family under the BGP neighbor is what activates this exchange on Nexus 9000. Without it, BGP may form but never advertise Type 2 or Type 5 routes, so remote hosts stay unknown.

Answer

address-family vpnv4 unicast

Answer

address-family link-state

Answer

address-family ipv4 unicast