350-601 Network Practice Test 18 — 15 Questions

Question 1

An engineer is designing a Cisco ACI fabric. The requirement is to allow communication between an EPG in tenant A and an EPG in tenant B. The engineer needs to configure the appropriate construct to permit this traffic. Which ACI object should be used to define the rules that allow this communication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Contract. In Cisco ACI, communication between EPGs is governed by contracts. A contract contains subjects and filters that define the allowed traffic. To enable communication between EPGs in different tenants, the contract must be configured appropriately, often using exported contracts or shared services. Bridge domains, VRFs, and filters are supporting objects but do not directly permit inter-EPG traffic.

Answer

VRF

Answer

Filter

Answer

Bridge Domain

Question 2

An engineer is configuring an ACI fabric and needs to ensure that traffic between two EPGs is permitted. The engineer has created a contract with a filter that allows TCP port 443. Which two additional configurations are required to make the contract effective? (Choose two.)

Accepted Answer

Associate the contract as a provider to the EPG that offers the service.. In ACI, a contract defines the rules for communication between EPGs. For the contract to be effective, it must be provided by the EPG offering the service and consumed by the EPG accessing the service. These two associations create the relationship that allows the filter to be applied. Without both, the contract is not enforced, and traffic between the EPGs remains denied by the implicit deny rule.

Answer

Create a taboo contract to explicitly deny all other traffic between the EPGs.

Answer

Configure a service graph to insert a firewall between the EPGs.

Answer

Apply a contract interface to the spine switches to enforce the filter.

Question 3

A network engineer is configuring a Cisco Nexus 9000 switch running NX-OS 9.3 as a leaf in a VXLAN EVPN fabric. The engineer wants to implement a Layer 3 underlay using OSPF and needs to verify the OSPF neighbor adjacency with the spine switch. The engineer runs the command 'show ip ospf neighbors' but sees no neighbors listed. The physical interfaces are up and IP connectivity to the spine's loopback is confirmed. Which action should the engineer take to establish the OSPF adjacency?

Accepted Answer

Enable OSPF on the interfaces connecting to the spine using the 'ip router ospf 1 area 0' command under the interface configuration.. OSPF adjacencies on NX-OS require OSPF to be enabled on the participating interfaces. After configuring the OSPF process, the engineer must enable OSPF on each interface with the 'ip router ospf 1 area 0' command. Physical connectivity and IP reachability alone do not activate OSPF; the protocol must be explicitly enabled per interface. This is a common oversight when configuring OSPF on Nexus switches.

Answer

Configure the OSPF router ID manually using the 'router-id' command under the OSPF process.

Answer

Configure OSPF authentication on both the leaf and spine interfaces to match the authentication settings.

Answer

Change the OSPF network type on the interfaces to point-to-point using the 'ip ospf network point-to-point' command.

Question 4

A network engineer is troubleshooting a VXLAN EVPN fabric where a leaf switch is not learning remote MAC addresses. The engineer verifies that the underlay OSPF adjacencies are up, BGP EVPN peering is established, and the NVE interface is up. The engineer suspects an issue with the EVPN route advertisement. Which command should be used to verify that the leaf switch is receiving Type-2 EVPN routes from remote VTEPs?

Accepted Answer

show bgp l2vpn evpn route-type 2. To verify that Type-2 EVPN routes are being received, the engineer should use 'show bgp l2vpn evpn route-type 2'. This command filters the EVPN RIB to show only MAC/IP Advertisement routes. It provides details such as the MAC address, IP address, and next-hop VTEP. If routes are missing, the engineer can further investigate BGP EVPN peering or route filters.

Answer

show ip route ospf

Answer

show bgp l2vpn evpn summary

Answer

show nve peers

Question 5

A network engineer is designing a VXLAN EVPN fabric with Cisco Nexus 9000 switches. The engineer must choose a mechanism for BUM (Broadcast, Unknown Unicast, Multicast) traffic handling. Which two options are valid BUM traffic handling mechanisms in a VXLAN EVPN fabric? (Choose two.)

Accepted Answer

Multicast underlay using PIM-SM. In a VXLAN EVPN fabric, BUM traffic can be handled using ingress replication or multicast in the underlay. Ingress replication involves the ingress VTEP replicating packets to all remote VTEPs. Multicast underlay uses a multicast group per VNI, with PIM-SM in the underlay to replicate traffic efficiently. Both are valid and commonly deployed depending on scale and requirements.

Answer

Static VXLAN tunnels

Answer

BGP EVPN route reflectors

Answer

Anycast RP with MSDP

Question 6

An engineer is deploying a VXLAN EVPN fabric with an OSPF underlay on Cisco Nexus 9000 switches. After adding a new spine switch, some leaf switches experience routing instability. The engineer suspects that the OSPF hello and dead timers are mismatched between the new spine and the leaf switches. Which action should be taken to resolve this issue?

Accepted Answer

Configure the same OSPF hello and dead timers on all interfaces.. OSPF neighbor adjacencies require matching hello and dead timers. If the new spine has different timers than the leaf switches, adjacencies will not form or will flap, leading to routing instability. The correct action is to configure identical timers on all interfaces involved. Changing network type, enabling authentication, or adjusting cost does not fix a timer mismatch.

Answer

Change the OSPF network type to point-to-point on the spine interfaces.

Answer

Enable OSPF authentication on all interfaces.

Answer

Adjust the OSPF cost on the leaf interfaces.

Question 7

A data center engineer is deploying a VXLAN EVPN fabric using Cisco Nexus 9000 switches. The engineer wants to ensure that the fabric supports multitenancy with overlapping IP addresses across different tenants. The design uses a spine-leaf topology with BGP EVPN as the control plane. Which feature must be enabled on the leaf switches to allow overlapping IP addresses in different VRFs?

Accepted Answer

Virtual Routing and Forwarding (VRF) instances. To support overlapping IP addresses across tenants, the fabric must maintain separate routing tables per tenant. VRF instances provide this isolation on Nexus switches. In a VXLAN EVPN fabric, each VRF is mapped to a Layer 3 VNI and uses unique route distinguishers and route targets to exchange routes. While anycast gateway and BGP EVPN attributes are important, they depend on VRFs. Thus, VRFs are the fundamental feature enabling multitenancy with overlapping IPs.

Answer

VXLAN Network Identifier (VNI) to VLAN mapping

Answer

BGP EVPN route distinguishers (RDs) and route targets (RTs)

Answer

Anycast gateway with distributed IP routing

Question 8

An engineer is deploying a new Cisco Nexus 9000 leaf switch into an existing VXLAN EVPN fabric. The underlay uses OSPF area 0 and the overlay uses iBGP with the spines as route reflectors. After the leaf is racked and cabled, the engineer notices that no Type-2 or Type-5 routes are being received from the spines, even though the OSPF neighbor relationships are FULL. Which configuration step was most likely missed on the new leaf?

Accepted Answer

The leaf must be configured with the 'feature nv overlay' and 'nv overlay evpn' commands, and the BGP neighbor must be activated under the L2VPN EVPN address family.. In a VXLAN EVPN fabric, the underlay (OSPF) provides IP reachability between VTEPs, but the overlay control plane requires BGP EVPN. The L2VPN EVPN address family must be enabled and the BGP neighbor must be activated under that address family for the leaf to receive Type-2 (MAC/IP) and Type-5 (IP prefix) routes. Without it, the leaf only exchanges IPv4 unicast routes and cannot learn remote MAC addresses or prefixes.

Answer

The leaf must be configured with the 'system bridge-domain' and 'system nve infra-vlans' commands to enable VXLAN encapsulation.

Answer

The leaf must be configured with a static VXLAN tunnel endpoint (VTEP) mapping for each spine to establish the overlay.

Answer

The leaf must be configured with a unique OSPF router ID that is higher than all spine router IDs to become a designated router.

Question 9

An engineer is configuring an ACI fabric and needs to allow traffic between two EPGs that reside in different tenants. The security policy requires that the communication be explicitly permitted and that the provider EPG expose only TCP port 443. Which ACI construct should the engineer configure?

Accepted Answer

A contract with a filter containing a TCP destination port 443 entry, exported and imported between the tenants.. Contracts in ACI define the rules for inter-EPG communication, and each contract contains subjects with filters that match specific protocols and ports. For cross-tenant communication, the contract must be exported from the provider tenant and imported into the consumer tenant so the consumer EPG can reference it. A filter matching TCP destination port 443 restricts the allowed traffic to HTTPS only.

Answer

A taboo contract applied to both EPGs to deny all traffic except port 443.

Answer

A VRF leak configured between the two tenants with an external EPG.

Answer

A bridge domain shared between the two tenants with a static path binding.

Question 10

A network administrator is configuring a Cisco Nexus 9000 switch in a data center. The administrator needs to enable a feature that allows the switch to participate in a VXLAN EVPN fabric. Which command must be run first to enable the necessary feature on the switch?

Accepted Answer

feature nv overlay. On Cisco Nexus 9000 switches, VXLAN is configured under the NVE interface, which requires the NVO feature. The command 'feature nv overlay' enables this capability. After enabling NVO, you can create an NVE interface, specify the source loopback, and map VNIs to VLANs. Other features like BGP and interface-VLAN may be needed for a full EVPN deployment, but NVO is the foundational feature for VXLAN.

Answer

feature interface-vlan

Answer

feature vxlan

Answer

feature bgp

Question 11

An engineer is troubleshooting a VXLAN EVPN fabric where a leaf switch is not learning remote MAC addresses from another leaf. The engineer verifies that the underlay OSPF adjacencies are up and that the BGP EVPN session between the leaf and spine is established. Which command should the engineer use to verify that the local VTEP is correctly advertising its MAC addresses to the remote VTEP?

Accepted Answer

show bgp l2vpn evpn. The 'show bgp l2vpn evpn' command is the most direct way to verify BGP EVPN routes, including MAC address advertisements (Type 2) and IMET routes (Type 3). By checking this table, the engineer can see if the local VTEP is advertising its MAC addresses and if the remote VTEP's advertisements are present. This helps isolate whether the problem is with advertisement or reception.

Answer

show ip ospf neighbor

Answer

show nve peers

Answer

show mac address-table

Question 12

An engineer is deploying a new Cisco Nexus 9000 switch in a data center. The switch will be used as a leaf in a VXLAN EVPN fabric. The engineer needs to configure the underlay routing protocol to support the fabric. Which routing protocol is recommended for the underlay in a VXLAN EVPN fabric?

Accepted Answer

eBGP with spine-leaf peering. eBGP is the recommended underlay routing protocol for VXLAN EVPN fabrics on Cisco Nexus 9000 switches. It offers scalability, fast convergence, and tight integration with the EVPN overlay, which also uses BGP. This combination simplifies operations and is widely adopted in data center designs.

Answer

OSPFv2 with point-to-point links

Answer

EIGRP with named mode

Answer

IS-IS with multi-level hierarchy

Question 13

A network engineer is configuring a Cisco Nexus 9000 leaf switch that will act as a VXLAN Tunnel Endpoint (VTEP). The switch must advertise its local MAC addresses to remote VTEPs using BGP EVPN, and the fabric uses a spine-leaf topology where each leaf peers with every spine. Which configuration is required on the leaf to allow the BGP EVPN address family to exchange MAC reachability information?

Accepted Answer

Enable the L2VPN EVPN address family under the BGP routing process and configure the spines as EVPN neighbors with the send-community extended attribute.. BGP EVPN on NX-OS requires the L2VPN EVPN address family to be enabled under the BGP process, and neighbor sessions must be configured with send-community extended so that the route target and encapsulation extended communities are propagated. Without these, remote VTEPs cannot import the MAC and IMET routes, breaking Layer 2 reachability across the VXLAN overlay.

Answer

Enable the IPv6 unicast address family and configure the VTEP source interface as a BGP next-hop for MAC routes.

Answer

Enable the IPv4 unicast address family and redistribute the MAC address table into BGP using the redistribute mac command.

Answer

Configure a route reflector on each leaf and enable the VPNv4 address family between all leaf switches.

Question 14

A network administrator is configuring a Cisco Nexus 9000 switch and wants to enable the VXLAN feature so that the NVE interface can be created. Which command must be issued first in global configuration mode?

Accepted Answer

feature nv overlay. On Cisco NX-OS, VXLAN is enabled with the 'feature nv overlay' command, which makes the NVE interface configuration available. This must be done before configuring interface nve1 and its member VNIs. Without enabling the feature, the switch cannot terminate VXLAN tunnels or participate in an EVPN overlay.

Answer

feature interface-vlan

Answer

feature vxlan

Answer

feature tunnel

Question 15

A network engineer is troubleshooting a VXLAN EVPN fabric. Host A on leaf1 cannot communicate with Host B on leaf2, even though both hosts are in the same VLAN and VNI. The engineer verifies that the VXLAN tunnel between leaf1 and leaf2 is up, and BGP EVPN routes are exchanged. The engineer suspects an issue with MAC address learning. Which statement describes a correct behavior of MAC address learning in a VXLAN EVPN fabric?

Accepted Answer

MAC addresses are advertised via BGP EVPN as Type-2 routes and can also be learned in the data plane.. In a VXLAN EVPN fabric, MAC addresses are distributed via BGP EVPN Type-2 routes, which contain the MAC, IP, VNI, and VTEP next-hop. This control-plane learning allows leaf switches to install MAC entries without data plane flooding. Data plane learning can also occur as a fallback, but the primary mechanism is control-plane. The issue described might be due to a failure in BGP EVPN route advertisement or programming, not necessarily data plane learning.

Answer

MAC addresses are learned only through the BGP EVPN control plane and never in the data plane.

Answer

MAC addresses are learned only in the data plane through VXLAN encapsulated traffic.

Answer

MAC addresses are learned by flooding unknown unicast traffic to all VTEPs, which then respond with their MAC tables.