350-401 Network Function Virtualization — Timed 20 Questions

Question 1

A company is migrating its legacy firewall services to a virtualized environment using Cisco NFV. The network engineer deploys a virtual firewall (vFW) on an NFVIS-enabled UCS platform. After the deployment, traffic through the vFW is intermittent and performance monitoring shows high CPU usage on the host. Which action should the engineer take to improve performance?

Accepted Answer

Enable SR-IOV on the physical NICs and assign VFs to the vFW.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch and reducing CPU overhead for packet processing. In an NFVIS environment, high host CPU usage with intermittent traffic indicates that the vFW is consuming excessive CPU cycles due to software-based I/O. Assigning VFs to the vFW offloads packet handling to the NIC hardware, lowering host CPU utilization and stabilizing traffic.

Answer

Increase the number of vCPUs allocated to the vFW VM.

Answer

Configure QoS policies on the vFW to prioritize traffic.

Answer

Disable hyperthreading on the host CPU.

Question 2

An enterprise is deploying a virtual router (vRouter) as part of its NFV infrastructure. The engineer needs to ensure that the vRouter can handle a sudden spike in traffic without dropping packets. The vRouter is running on a KVM hypervisor. What should the engineer configure to guarantee CPU resources for the vRouter during peak demand?

Accepted Answer

Configure CPU pinning and CPU reservation for the vRouter VM.. CPU pinning binds the vRouter's virtual CPUs to specific physical cores, preventing other processes from using them, while CPU reservation guarantees a minimum amount of CPU capacity. Together, they ensure deterministic CPU availability during traffic spikes, preventing packet drops due to resource contention on the KVM hypervisor.

Answer

Enable memory ballooning on the vRouter VM.

Answer

Enable DPDK on the vRouter's virtual NICs.

Answer

Set the vRouter VM to use NUMA node pinning.

Question 3

A network engineer is deploying a virtual WAN edge device using Cisco SD-WAN on an NFVIS platform. After powering on the VM, the device fails to boot and the NFVIS console shows 'ERROR: No bootable device found'. The engineer verified that the ISO image is correctly uploaded. What is the most likely cause?

Accepted Answer

The boot order in the VM configuration does not have the CD-ROM (ISO) as the first device.. Option C is correct because the error 'No bootable device found' indicates that the VM attempted to boot from a device that does not contain a bootable operating system. In NFVIS, when deploying a virtual WAN edge device from an ISO, the VM's boot order must be configured to prioritize the CD-ROM (ISO) device. If the boot order defaults to the virtual hard disk (which is empty before installation), the VM will fail to find a bootable medium and produce this exact error.

Answer

The VM's virtual disk size is too small for the WAN edge image.

Answer

The VM's CPU type is set to 'host-passthrough' instead of 'qemu64'.

Answer

The ISO image is corrupted and NFVIS cannot read it.

Question 4

An engineer is managing a Cisco NFVIS host running multiple virtual network functions (VNFs). The engineer needs to upgrade the NFVIS software to a new version that includes critical security patches. The upgrade process must minimize downtime. Which upgrade method should the engineer use?

Accepted Answer

Use the 'software install add' command to stage the image, then 'activate' and 'commit' with a single reboot.. Option B is correct because the 'software install add' command stages the new NFVIS image, followed by 'activate' and 'commit' with a single reboot, which minimizes downtime by performing the upgrade in a single reboot cycle. This method is the recommended approach for upgrading NFVIS while preserving existing VNF configurations and minimizing service disruption.

Answer

Use the 'patch install' command to apply the upgrade without rebooting.

Answer

Perform a clean installation of the new NFVIS version and redeploy all VNFs.

Answer

Migrate all VNFs to another NFVIS host, then upgrade the original host.

Question 5

A company uses Cisco NFVIS to host a virtual ASA (vASA) and a virtual router (vRouter). The engineer notices that the vASA cannot communicate with the vRouter even though both are on the same NFVIS host. The vASA is connected to a bridge network, and the vRouter is connected to a different bridge. What should the engineer do to enable communication between the two VNFs?

Accepted Answer

Create a new bridge that connects both VNFs, or use a virtual switch to route between the bridges.. In NFVIS, VNFs attached to different bridge networks are isolated at Layer 2. To enable communication between them, you must either create a new bridge that connects both VNFs or use a virtual switch (e.g., a Linux bridge with routing enabled) to forward traffic between the two bridges. This allows the VNFs to share a common Layer 2 domain or have a routed path through the hypervisor.

Answer

Connect a physical cable between two ports on the NFVIS host.

Answer

Configure VLAN tagging on both VNFs with the same VLAN ID.

Answer

Add a static route on each VNF pointing to the other VNF's IP address.

Question 6

An engineer is deploying a virtual network function (VNF) on a Cisco NFVIS host. The VNF requires four virtual NICs, each connected to a different network segment. The engineer creates four bridges on NFVIS and attaches each vNIC to a separate bridge. After deployment, the VNF can only communicate on the first bridge. What is the most likely cause?

Accepted Answer

The bridges are all mapped to the same physical interface without subinterfaces, causing a conflict.. In Cisco NFVIS, bridges are Layer 2 forwarding constructs that must be mapped to a physical interface (or subinterface) to provide external connectivity. When multiple bridges are all mapped to the same physical interface without using subinterfaces (e.g., GigabitEthernet0/0), they share the same VLAN and MAC domain, causing traffic from the second, third, and fourth bridges to be dropped or misdirected. The VNF can only communicate on the first bridge because that bridge's vNIC is the only one that successfully establishes a valid forwarding path through the physical interface.

Answer

The VNF's operating system does not support multiple NICs.

Answer

The vNICs have duplicate MAC addresses.

Answer

The bridges were created in the wrong order.

Question 7

A network engineer is troubleshooting a performance issue with a virtual firewall (vFW) running on a Cisco NFVIS host. The vFW is experiencing high packet loss during peak traffic. The engineer checks the NFVIS monitoring dashboard and sees that the vFW's CPU usage is low, but the host's memory usage is high. What is the most likely cause of the packet loss?

Accepted Answer

The host is under memory pressure, causing the hypervisor to swap or balloon memory from the vFW.. When the NFVIS host experiences high memory pressure, the hypervisor may reclaim memory from virtual machines (VMs) using mechanisms such as ballooning or swapping. This reduces the memory available to the vFW, causing it to drop packets because its packet buffers or operating system memory are forcibly reclaimed. The vFW's CPU remains low because the bottleneck is memory, not processing power.

Answer

The vFW is CPU-bound, but the monitoring is inaccurate.

Answer

The host's CPU is oversubscribed, causing vCPU starvation.

Answer

The vFW's packet buffer is exhausted, but the monitoring does not show it.

Question 8

An engineer is deploying a virtual router (vRouter) on a Cisco NFVIS host. The vRouter needs to advertise routes to a physical router connected to the host's management port. The engineer configures the vRouter with an IP address on the same subnet as the management port. However, the physical router does not receive any routing updates. What should the engineer do to enable route exchange?

Accepted Answer

Connect the vRouter to a data plane interface (e.g., a bridge connected to a physical data port) instead of the management port.. Option D is correct because in Cisco NFVIS, the management port is isolated from the data plane and is intended only for out-of-band management traffic. Routing protocols like OSPF or BGP cannot exchange routes over the management interface because it lacks the necessary data-plane forwarding capabilities. To advertise routes to a physical router, the vRouter must be connected to a data plane interface, such as a bridge mapped to a physical data port, which supports routing protocol adjacency and packet forwarding.

Answer

Configure a static route on the vRouter pointing to the physical router.

Answer

Enable OSPF on the vRouter's management interface.

Answer

Change the management port to a trunk port to carry routing updates.

Question 9

A company is deploying a virtual WAN optimizer (vWAAS) on a Cisco NFVIS host. The engineer needs to ensure that the vWAAS can intercept traffic between two VNFs running on the same host. The traffic currently flows directly between the VNFs without passing through the vWAAS. What should the engineer configure to redirect the traffic?

Accepted Answer

Create a service chain in NFVIS that places the vWAAS between the two VNFs.. Option A is correct because NFVIS supports service chaining, which allows an administrator to define a sequence of VNFs that traffic must traverse. By creating a service chain that places the vWAAS between the two VNFs, NFVIS will automatically redirect the traffic through the vWAAS using internal bridging or vSwitch forwarding rules, without requiring any configuration changes on the VNFs themselves.

Answer

Configure a static route on each VNF pointing to the vWAAS.

Answer

Enable WCCP on the vWAAS and configure the VNFs to use WCCP.

Answer

Use policy-based routing on the VNFs to forward traffic to the vWAAS.

Question 10

A company is deploying a virtualized network function (VNF) on a KVM-based host. The VNF requires dedicated CPU cores and must avoid performance interference from other VMs. Which hypervisor configuration best meets these requirements?

Accepted Answer

Configure CPU pinning and use dedicated NUMA nodes.. Option B is correct because CPU pinning binds the VNF's vCPUs to specific physical cores, ensuring dedicated CPU resources and preventing interference from other VMs. Using dedicated NUMA nodes further optimizes memory locality, reducing latency and avoiding cross-NUMA memory access, which is critical for performance-sensitive VNFs.

Answer

Enable CPU overcommitment and use a single NUMA node.

Answer

Use VMware vSphere with DRS set to Aggressive.

Answer

Deploy the VNF as a container instead of a VM.

Question 11

An architect is designing an SD-WAN deployment for a multinational enterprise. The design must ensure that control plane traffic remains separate from data plane traffic and that the solution can scale to thousands of sites. Which architectural component is responsible for maintaining the control plane and distributing routing information?

Accepted Answer

vSmart controller. The vSmart controller is the centralized control plane component in Cisco SD-WAN that distributes routing information (OMP routes) and policies to all vEdge/cEdge routers. It maintains the control plane by separating route advertisement and policy enforcement from the data plane, which is handled by the vEdge routers. This separation allows the solution to scale to thousands of sites because vSmart controllers can be clustered and do not process actual data traffic.

Answer

vBond orchestrator

Answer

vManage NMS

Answer

vEdge router

Question 12

A network team must design QoS for a campus network that carries voice, video, and data traffic. The design must use the DiffServ model and ensure that voice traffic is prioritized over all other traffic classes. Which DSCP marking and queuing strategy should be used for voice?

Accepted Answer

Mark voice with EF and place in a strict priority queue.. Option B is correct because voice traffic requires strict priority to ensure minimal jitter and latency. DSCP EF (Expedited Forwarding, per RFC 3246) is the standard marking for real-time traffic like voice, and placing it in a strict priority queue (LLQ) guarantees that voice packets are serviced before any other queue, which is essential for meeting QoS requirements in a DiffServ model.

Answer

Mark voice with AF41 and place in a weighted fair queue.

Answer

Mark voice with CS3 and place in a low-latency queue.

Answer

Mark voice with BE and rely on WRED for drop precedence.

Question 13

An enterprise is migrating its data center to a leaf-spine architecture. The design must provide high availability and support for east-west traffic patterns. Which design choice best meets these requirements?

Accepted Answer

Implement a leaf-spine topology with multiple spine switches and ECMP.. A leaf-spine topology with multiple spine switches and Equal-Cost Multi-Path (ECMP) routing provides high availability by eliminating single points of failure and supports east-west traffic patterns by ensuring that any leaf switch can reach any other leaf switch with a consistent number of hops (typically one hop via a spine). ECMP allows load balancing across all available spine links, maximizing bandwidth and redundancy for data center east-west flows.

Answer

Deploy a collapsed core with a single pair of core switches.

Answer

Use a three-tier hierarchical design with access, distribution, and core layers.

Answer

Use a ring topology connecting all switches in a loop.

Question 14

A service provider wants to deploy a virtualized firewall as a VNF in a service chain. The VNF must be inserted transparently into the traffic path without requiring changes to the existing IP addressing. Which service chaining method should the architect choose?

Accepted Answer

Implement policy-based routing (PBR) to redirect traffic to the VNF.. Policy-based routing (PBR) allows the architect to redirect traffic to the VNF based on match criteria such as source/destination IP or protocol, without altering the existing IP addressing scheme. This enables transparent insertion of the VNF into the service chain, as PBR overrides the routing table for selected traffic and forwards it to the virtualized firewall, while the original IP headers remain unchanged.

Answer

Use static routing to point traffic to the VNF.

Answer

Deploy the VNF in inline mode with proxy ARP.

Answer

Use VRF-lite to separate traffic and route through the VNF.

Question 15

An architect is designing an SD-Access fabric for a large enterprise campus. The design must support segmentation based on user identity and device type, and must integrate with Cisco ISE. Which fabric component and protocol should be used to enforce micro-segmentation?

Accepted Answer

Deploy Cisco TrustSec with SGTs and integrate with ISE.. Cisco TrustSec with Security Group Tags (SGTs) is the correct choice because it provides identity- and device-type-based micro-segmentation in an SD-Access fabric. SGTs are assigned by Cisco ISE based on user/device attributes, and the fabric enforces policies by tagging packets with SGTs, allowing granular traffic filtering regardless of IP address or VLAN.

Answer

Use VXLAN with BGP EVPN for segmentation.

Answer

Use LISP to map endpoints to virtual networks.

Answer

Implement VLAN-based segmentation with 802.1X.

Question 16

A company is deploying a virtualized router (CSR1000v) on VMware vSphere. The VNF must support high throughput and low latency. Which vSphere configuration option should the architect select to optimize network performance?

Accepted Answer

Enable SR-IOV on the physical NIC and assign virtual functions to the VM.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch. This reduces latency and CPU overhead, making it ideal for high-throughput, low-latency VNFs like the CSR1000v. Option B is correct because SR-IOV provides near-native performance by allowing the VM to directly access the NIC hardware.

Answer

Use the default e1000 NIC driver.

Answer

Use VMXNET3 paravirtualized NIC.

Answer

Configure the VM with multiple vCPUs and large memory.

Question 17

An architect is designing an SD-WAN policy to ensure that real-time video traffic from headquarters to branch offices is always sent over the most reliable transport, while all other traffic uses the least-cost path. Which type of policy should be used to achieve this?

Accepted Answer

Centralized data policy configured on vSmart.. A centralized data policy configured on vSmart is correct because it allows the SD-WAN controller to enforce application-aware routing decisions across the fabric. By matching real-time video traffic and steering it over the transport with the highest loss/reachability metrics (most reliable), while using a separate rule to direct all other traffic over the least-cost path, the policy is applied globally from the vSmart controller without requiring per-router configuration.

Answer

Localized data policy applied on the vEdge router.

Answer

Centralized control policy for route manipulation.

Answer

Localized app-route policy on the branch vEdge.

Question 18

A network team must design a QoS policy for a WAN link that carries voice, video, and data. The policy must ensure that voice traffic is never dropped, even during congestion. Which queuing mechanism should be used for the voice class?

Accepted Answer

Low-latency queuing (LLQ).. Low-latency queuing (LLQ) is the correct choice because it combines strict priority queuing with CBWFQ, allowing voice traffic to be placed in a strict priority queue that is serviced first before any other queues. This ensures that voice packets are never dropped due to congestion, as long as the configured policer rate is not exceeded, meeting the requirement that voice traffic is never dropped.

Answer

Class-based weighted fair queuing (CBWFQ).

Answer

Weighted random early detection (WRED).

Answer

First-in, first-out (FIFO) queuing.

Question 19

Examine the following configuration snippet:

interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip ospf hello-interval 20
 ip ospf dead-interval 80

What is the effect of this configuration?

Accepted Answer

The OSPF hello interval is changed to 20 seconds, and the dead interval is changed to 80 seconds, maintaining the default 4:1 ratio.. Option A is correct because the configuration explicitly sets the OSPF hello interval to 20 seconds and the dead interval to 80 seconds, which maintains the default 4:1 ratio (dead = hello × 4). OSPF allows manual configuration of these timers, and as long as both sides of the adjacency match, the ratio can be any value; the 4:1 default is not enforced by the protocol.

Answer

The OSPF hello interval is changed to 20 seconds, but the dead interval remains at the default of 40 seconds.

Answer

The OSPF hello interval is changed to 20 seconds, and the dead interval is automatically set to 60 seconds.

Answer

This configuration will cause OSPF adjacency failure because the dead interval must be exactly 4 times the hello interval.

Question 20

Consider the following configuration:

router eigrp TEST
 network 10.0.0.0 0.255.255.255
 metric weights 0 1 0 1 0 0

What is the effect of the 'metric weights' command?

Accepted Answer

It changes the EIGRP metric calculation to use only bandwidth and delay, which is the default behavior.. The 'metric weights' command in EIGRP allows you to modify the K values used in the composite metric formula. The default K values are K1=1, K2=0, K3=1, K4=0, K5=0, which means only bandwidth (K1) and delay (K3) are used. The command 'metric weights 0 1 0 1 0 0' explicitly sets K1=1, K3=1, and all others to 0, which matches the default behavior and does not change the metric calculation.

Answer

It changes the EIGRP metric calculation to use bandwidth, delay, and reliability.

Answer

It changes the EIGRP metric calculation to use only delay.

Answer

It disables the EIGRP metric calculation, causing all routes to have the same metric.