350-401 Virtualization Practice Questions

Question 1

A network engineer is troubleshooting a Cisco IOS-XE router that hosts multiple virtual routing and forwarding (VRF) instances. Users in VRF-A report they cannot reach a server in VRF-B. The engineer verifies that both VRFs have the correct routes and that the router has a route leaking configuration using route-target import/export. However, connectivity still fails. What is the most likely cause?

Accepted Answer

The import map is missing in VRF-B.. Option D is correct because route leaking between VRFs using route-target import/export requires both an export configuration on the source VRF and an import configuration on the destination VRF. If VRF-B lacks an import map (or the route-target import statement), it will not accept the routes exported from VRF-A, even if VRF-A has the correct export configuration. This is a common misconfiguration in MPLS L3VPN or VRF-lite route leaking scenarios.

Answer

The router does not have iBGP configured between the VRFs.

Answer

The route-target export is not configured in VRF-A.

Answer

The router is using VRF-lite, which does not support route leaking.

Question 2

A data center uses Cisco Nexus 9000 switches with VXLAN EVPN to provide network virtualization. The operations team notices that VLAN 100 (mapped to VNI 10100) is not reachable across the fabric, although other VLANs work fine. The NVE interface is up, and the EVPN address-family is configured. Which two actions should the engineer take to isolate the issue?

Accepted Answer

Verify that VLAN 100 is mapped to VNI 10100 consistently on all VTEPs.. Option C is correct because VXLAN EVPN requires consistent VLAN-to-VNI mapping across all VTEPs in the fabric. If VLAN 100 is mapped to VNI 10100 on some switches but not others, traffic for that VNI will not be forwarded correctly, as the mapping is used to associate local VLANs with the VXLAN segment. Option D is correct because the VNI must be explicitly enabled under the NVE interface to participate in VXLAN tunnel termination; without it, the VTEP will not encapsulate or decapsulate traffic for VNI 10100.

Answer

Check if EVPN type-3 routes are being advertised for VNI 10100.

Answer

Confirm that multicast group 239.1.1.1 is reachable across the underlay.

Answer

Check if the MTU on the underlay is set to at least 1550 bytes.

Question 3

A network engineer is deploying a Cisco Catalyst 9300 switch as a virtual switch using StackWise Virtual. The switch will connect to two upstream routers for redundancy. What is the best practice for connecting the uplinks?

Accepted Answer

Bundle the uplinks into an EtherChannel that spans both stack members.. Option A is correct because in a StackWise Virtual deployment, the two member switches operate as a single logical switch. Bundling the uplinks into an EtherChannel that spans both stack members provides both link redundancy and load balancing, and it ensures that if one member fails, traffic continues to flow through the remaining member without requiring routing protocol convergence or STP reconvergence.

Answer

Use two separate routed interfaces, each with a routing protocol.

Answer

Connect each uplink to the active switch member.

Answer

Configure the uplinks in active/standby mode using STP.

Question 4

A cloud provider uses Cisco ACI to automate provisioning of tenant networks. A new tenant requires a Layer 2 bridge domain that extends to an external Layer 2 network via a VPC. The engineer creates a bridge domain with the settings: Type: Regular, L2 Unknown Unicast: Flood, L3 Unknown Multicast Flood: Flood, and Multi-Destination Flooding: Flood. The VPC is configured as a virtual port channel. The tenant reports that broadcast traffic is not reaching the external network. What is the most likely cause?

Accepted Answer

The L2Out is not configured to flood BUM traffic.. The correct answer is C because the bridge domain is configured to flood BUM (Broadcast, Unknown Unicast, and Multicast) traffic internally, but the L2Out (Layer 2 external connection) must also be explicitly configured to flood BUM traffic to the external network. Without this configuration on the L2Out, the ACI fabric will not forward broadcast or multicast frames across the VPC to the external Layer 2 network, even though the bridge domain itself permits flooding.

Answer

The VPC configuration does not support L2 extension.

Answer

The bridge domain is configured as proxy mode for L2 unknown unicast.

Answer

The bridge domain type should be set to 'L2 Only'.

Question 5

An enterprise uses VMware vSphere to host multiple virtual machines (VMs). The network team wants to implement a virtual firewall on the hypervisor to inspect traffic between VMs on the same ESXi host. Which technology should be used?

Accepted Answer

Deploy a virtual firewall on a vSphere Distributed Switch with a private VLAN.. Option B is correct because deploying a virtual firewall on a vSphere Distributed Switch (VDS) with a private VLAN (PVLAN) allows the firewall to inspect east-west traffic between VMs on the same ESXi host without sending traffic off the host. The VDS supports PVLANs to isolate VM traffic and redirect it to the virtual firewall for inspection, enabling granular security within the hypervisor.

Answer

Use VXLAN to encapsulate traffic and send it to a firewall.

Answer

Use a vSphere Standard Switch and configure port mirroring.

Answer

Deploy a physical firewall and route all VM traffic through it.

Question 6

A network engineer configured three interfaces on a switch as shown. A host connected to Ethernet1/2 sends an untagged frame. Which VLAN will this frame be placed into when it reaches Ethernet1/3?

Accepted Answer

The frame is dropped because VLAN 10 is not allowed.. The switchport on Ethernet1/3 is configured as a trunk with an allowed VLAN list that does not include VLAN 10. When the untagged frame from Ethernet1/2 enters the switch, it is assigned to the native VLAN of the access port (which is VLAN 10 by default or configuration). As the frame is switched to the trunk port Ethernet1/3, the trunk's allowed VLAN list is checked; since VLAN 10 is not permitted, the frame is dropped at the egress trunk port.

Answer

VLAN 999

Answer

VLAN 1

Answer

VLAN 10

Question 7

An engineer configures VXLAN EVPN on a Nexus 9000 switch. The configuration is shown. The switch does not advertise any EVPN routes for VNI 10100. Which configuration change is required to fix this issue?

Accepted Answer

Configure "evpn" and "vni 10100 l2" under the BGP address-family l2vpn evpn.. Option A is correct because for VXLAN EVPN on a Nexus 9000, the BGP address-family l2vpn evpn must explicitly contain the 'evpn' keyword and the 'vni 10100 l2' command to advertise Layer 2 VNI routes. Without this configuration, BGP does not know to inject the VNI's MAC/VTEP information into the EVPN route table, so no EVPN routes are advertised for VNI 10100.

Answer

Remove the mcast-group from the NVE member, because EVPN uses BGP for control plane.

Answer

Change the source-interface to a physical interface.

Answer

Add an IP address to the VLAN 100 interface in the default VRF.

Question 8

Which TWO of the following are benefits of using network virtualization with VXLAN? (Choose two.)

Accepted Answer

Enables Layer 2 extension across Layer 3 boundaries.. VXLAN encapsulates Layer 2 frames in UDP packets over IP, allowing Layer 2 segments to be stretched across Layer 3 networks. This enables virtual machine mobility and multi-tenant environments without being constrained by physical network boundaries.

Answer

Eliminates the need for STP by using a centralized controller.

Answer

Uses only multicast for control plane learning.

Answer

Provides native encryption for data in transit.

Question 9

Which THREE of the following are components of a Cisco ACI fabric? (Choose three.)

Accepted Answer

Spine switch. The spine switch is a core component of a Cisco ACI fabric, forming the spine-leaf topology. Spine switches provide high-speed, non-blocking connectivity between leaf switches and handle all east-west traffic, relying on IS-IS as the routing protocol for fabric discovery and forwarding.

Answer

Firewall

Answer

Router

Question 10

A financial services company has deployed Cisco UCS servers with VMware vSphere 7.0 to host critical trading applications. The network uses Cisco Nexus 9000 switches in a VXLAN EVPN fabric with BGP as the underlay. The environment includes 50 ESXi hosts, each connected via two 40G interfaces to two different leaf switches in a VPC. The VMs are spread across multiple hosts and communicate over VXLAN. Recently, the operations team migrated a set of VMs from an old VLAN-based network to a new VXLAN segment (VNI 50000). After the migration, users report intermittent connectivity issues and packet loss. The engineering team captures traffic and notices that some VMs send ARP requests that are not being replied to, even though the target VM is active. Further analysis shows that the ARP requests are being flooded to all VTEPs, but the replies are not reaching the source. The team checks the underlay and finds no issues with BGP or routing. The NVE interfaces are up, and the VNI is configured. Which of the following is the most likely cause of the issue?

Accepted Answer

The MAC address of the target VM is not being advertised in EVPN type-2 routes because the VM's MAC is learned on a different leaf switch than expected.. The issue is that the target VM's MAC address is not being advertised via EVPN Type-2 routes from the leaf switch where it resides. When the source VM sends an ARP request, the ingress VTEP floods it to all VTEPs in the VNI's ingress replication list, but the reply from the target VM must be unicast back. If the target's MAC is not in the EVPN control plane (e.g., because it was learned on a different leaf than expected due to asymmetric MAC learning or stale entries), the reply cannot be forwarded correctly, causing intermittent connectivity.

Answer

The ingress replication list is missing some VTEPs.

Answer

The symmetric routing configuration is missing on the leaf switches.

Answer

The VPC configuration between the leaf switches and ESXi hosts is incorrect.

Virtualization

350-401 Virtualization — Key Topics

Where candidates lose marks on Virtualization