350-401 Virtualization Practice Test 3 — 15 Questions

Question 1

A network engineer must configure a Cisco IOS-XE router so that interface GigabitEthernet0/0/1 belongs to an existing VRF named CUSTOMER_A. Which command sequence correctly accomplishes this?

Accepted Answer

interface GigabitEthernet0/0/1 followed by vrf forwarding CUSTOMER_A. In IOS-XE, an interface is placed into an existing VRF by entering interface configuration mode and issuing vrf forwarding followed by the VRF name. The command strips the interface's current IP address, so the address must be reconfigured, but it correctly binds the interface to the CUSTOMER_A routing table.

Answer

interface GigabitEthernet0/0/1 followed by ip vrf forwarding CUSTOMER_A

Answer

interface GigabitEthernet0/0/1 followed by ip vrf CUSTOMER_A

Answer

interface GigabitEthernet0/0/1 followed by vrf definition CUSTOMER_A

Question 2

A network engineer is deploying Cisco ACI in a data center to automate tenant network provisioning. The engineer needs to ensure that the ACI fabric can integrate with an existing VMware vSphere environment using the Cisco Application Virtual Switch (AVS). Which two components are required to enable this integration? (Choose two.)

Accepted Answer

Cisco APIC controller. Integrating Cisco ACI with VMware vSphere using Cisco AVS requires the Cisco APIC controller and VMware vCenter Server. The APIC manages the ACI fabric and communicates with the AVS via OpFlex to enforce network policies. vCenter is needed to deploy and manage the AVS and to coordinate virtual machine networking. Other options like Nexus 1000V, DCNM, and UCS Manager are not required for this specific integration.

Answer

Cisco UCS Manager

Answer

Cisco DCNM

Answer

Cisco Nexus 1000V

Question 3

A network administrator is deploying a virtual switch in a VMware vSphere environment and wants to enable Cisco Discovery Protocol (CDP) on the virtual switch so that the physical switch can see the virtual machine NICs. Which Cisco virtual switch feature should the administrator enable?

Accepted Answer

CDP on the vSphere Distributed Switch (vDS) under the advanced settings. VMware vSphere Distributed Switches support CDP and LLDP, and CDP can be enabled in the advanced settings of the vDS. This allows the physical switch to discover the virtual switch and the virtual machine NICs connected to it. Standard virtual switches do not support these discovery protocols, so a vDS is required.

Answer

Cisco Nexus 1000V with CDP enabled on the uplink port profile

Answer

Port mirroring on the virtual switch to send CDP packets to the physical switch

Answer

LLDP on the standard virtual switch (vSS) in the vSphere Client

Question 4

A network engineer is troubleshooting a Cisco IOS-XE router that supports VRF-Lite. Interfaces Gi0/1 and Gi0/2 are assigned to VRF CUSTOMER_A, while Gi0/3 remains in the global routing table. A static route for 192.168.50.0/24 is configured inside VRF CUSTOMER_A, but traffic sourced from the global table cannot reach that prefix. What is the most likely cause?

Accepted Answer

The static route must be redistributed into the global table because VRFs cannot be reached without route leaking.. VRF-Lite isolates routing and forwarding tables, so a prefix known only inside VRF CUSTOMER_A cannot be reached from the global table without an explicit leak. IOS-XE supports leaks through static routes that reference the global table, or by configuring a matching return route in the global table pointing at the VRF interface. Redistribution alone does not merge VRF and global tables; a deliberate route-leaking construct is required for the two contexts to exchange reachability.

Answer

The static route must be configured on the global table using a next-hop inside VRF CUSTOMER_A, because IOS-XE forbids static routes within VRFs.

Answer

The interfaces Gi0/1 and Gi0/2 need `ip vrf forwarding CUSTOMER_A` removed so all interfaces share the global table.

Answer

A route distinguisher must be configured on VRF CUSTOMER_A before any static route becomes usable.

Question 5

A network engineer is configuring a Cisco IOS-XE router to support a virtual routing and forwarding (VRF) instance for a customer. The engineer wants to verify that the VRF is correctly configured and that interfaces are assigned to it. Which command displays the interfaces associated with a specific VRF?

Accepted Answer

show vrf CUSTOMER_A interface. The 'show vrf CUSTOMER_A interface' command is specifically designed to list interfaces assigned to a given VRF. It provides details such as interface name, IP address, and VRF status. This directly answers the engineer's need to verify that interfaces are correctly assigned to the VRF. Other commands show VRF lists or routing tables but do not focus on interface assignments for a specific VRF.

Answer

show ip route vrf CUSTOMER_A

Answer

show ip vrf interfaces

Answer

show vrf

Question 6

A network engineer is configuring a Cisco CSR 1000v router to run as a virtual machine on a VMware ESXi host. The router needs to forward traffic between two VLANs. Which type of virtual interface must be configured on the CSR 1000v to connect to the ESXi virtual switches?

Accepted Answer

Virtual NIC (vNIC) on the CSR 1000v that maps to a vSwitch port group. To route between VLANs, the CSR 1000v needs multiple virtual NICs (vNICs). Each vNIC connects to a port group on the ESXi host that is associated with a specific VLAN. The router then treats each vNIC as a separate physical interface, allowing it to route traffic between the VLANs. This is the standard deployment for virtual routers.

Answer

Subinterfaces on a single vNIC with 802.1Q encapsulation

Answer

Virtual switch (vSwitch) with VLAN tagging enabled on the CSR 1000v

Answer

Physical NIC (pNIC) on the ESXi host that is passed through to the CSR 1000v

Question 7

A network engineer is configuring a Cisco Nexus 9000 switch for VXLAN EVPN. The engineer wants to verify that the NVE interface is operational and that the VNI is properly mapped. Which command should the engineer use?

Accepted Answer

show nve vni. The `show nve vni` command is used to verify the VNI configuration on a Cisco Nexus 9000 switch. It displays the VNI number, the associated VLAN, the VNI mode (L2 or L3), and the status (up/down). This allows the engineer to confirm that the VNI is properly mapped and operational. Other commands like `show nve interface` or `show interface nve1` provide different information.

Answer

show nve interface

Answer

show vxlan vni

Answer

show interface nve1

Question 8

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not learning remote MAC addresses from other VTEPs. The engineer verifies that the underlay is operational and that BGP EVPN peering is established. Which action should the engineer take to troubleshoot the issue?

Accepted Answer

Verify that the VNI is mapped to the correct VLAN and that the EVPN address family is enabled.. The most likely cause of the switch not learning remote MAC addresses is a misconfiguration of the VNI-to-VLAN mapping or the EVPN address family. The VNI must be mapped to a VLAN, and the EVPN address family must be enabled under BGP for the switch to advertise and receive MAC routes. Other issues like MTU or anycast gateway MAC would not prevent MAC learning via EVPN, and since BGP peering is established, source interface configuration is not the problem.

Answer

Verify that the BGP EVPN peering is using the correct source interface and that the update-source is configured.

Answer

Check the MTU settings on the underlay interfaces and adjust if necessary.

Answer

Ensure that the anycast gateway MAC address is unique on each VTEP.

Question 9

A network engineer is deploying a VXLAN EVPN fabric with Cisco Nexus 9000 switches. The underlay uses OSPF for routing, and the overlay uses BGP EVPN. The engineer notices that some leaf switches are not forming BGP EVPN peering with the spine switches. Which action should be taken to troubleshoot this issue?

Accepted Answer

Verify that the loopback interfaces used for BGP EVPN peering are reachable via the underlay routing protocol.. BGP EVPN peering requires IP reachability between the loopback interfaces of the peering devices. If the underlay routing protocol is not advertising the loopbacks, BGP sessions will fail. Therefore, verifying reachability is the first troubleshooting step. Other options, while important for overall EVPN operation, do not directly affect BGP peering establishment.

Answer

Check that the anycast gateway MAC address is consistent across all leaf switches.

Answer

Confirm that the BGP EVPN address family is activated on the spine switches and that neighbor activation is configured.

Answer

Ensure that the NVE interface is configured with the correct VNID for each VLAN.

Question 10

A network engineer is configuring VXLAN on a Cisco Nexus 9000 switch. The engineer wants to map VLAN 100 to VXLAN Network Identifier (VNI) 10100. Which command is used to create this mapping?

Accepted Answer

interface nve1; member vni 10100; mapping vlan 100. The correct method to map a VLAN to a VNI is to configure the NVE interface. Under 'interface nve1', the 'member vni 10100' command creates the VNI, and the subsequent 'mapping vlan 100' command associates VLAN 100 with that VNI. This mapping is essential for VXLAN encapsulation and decapsulation on the VTEP. Other commands listed are either invalid or incorrectly formatted.

Answer

vxlan vlan 100 vni 10100

Answer

member vni 10100 vlan 100

Answer

vlan 100 vni 10100

Question 11

A network administrator is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The administrator needs to verify that the VRF is active and that interfaces are assigned to it. Which command should be used to display the VRF configuration and its associated interfaces?

Accepted Answer

show vrf detail. The 'show vrf detail' command provides a comprehensive view of each VRF, including its route distinguisher, route targets, and assigned interfaces. This directly verifies that the VRF is active and that interfaces are correctly assigned. Other commands either provide only partial information or are not appropriate for the platform. Therefore, 'show vrf detail' is the correct choice for the administrator's task.

Answer

show ip route vrf

Answer

show ip vrf

Answer

show vrf

Question 12

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The engineer must configure the underlay to support the overlay. Which two routing protocols are commonly used for the underlay? (Choose two.)

Accepted Answer

BGP. In VXLAN EVPN fabrics, the underlay network must provide IP reachability between VTEP loopback addresses. OSPF and BGP are the most common choices. OSPF is often used in smaller fabrics due to its simplicity, while BGP is preferred in larger, more scalable designs. Both are widely supported and documented by Cisco for Nexus 9000 VXLAN EVPN deployments.

Answer

RIP

Answer

EIGRP

Answer

IS-IS

Question 13

A network engineer is implementing Cisco ACI in a data center. The design requires that an endpoint be reachable across multiple leaf switches while maintaining a consistent policy, and that a Layer 2 bridge domain extend to a remote site over an L3Out. Which two ACI constructs are required to meet these goals? (Choose two.)

Accepted Answer

A VXLAN network identifier (VNI) mapped to an EPG to define the Layer 2 overlay segment.. ACI stretches a Layer 2 segment by mapping an EPG to a VNI, which identifies the overlay across leaf switches. The tenant's VRF provides the isolated routing context required for the bridge domain and for the L3Out that connects to the remote site. Contracts, SPAN, and the L3Out itself address policy, monitoring, or external peering rather than the overlay segment identity and routing isolation needed here.

Answer

An L3Out configured on a leaf switch to peer with the remote site's router.

Answer

A contract applied between EPGs to permit the required traffic flows.

Answer

A fabric-wide SPAN session that mirrors all endpoint traffic to an external analyzer.

Question 14

A company is deploying a Cisco ACI fabric and wants to connect a new tenant's Layer 3 routed traffic between two EPGs. The requirement is that the two EPGs can communicate at Layer 3 only through a defined set of subnets, with policy enforced in hardware. Which ACI construct should the engineer configure to meet this requirement?

Accepted Answer

A bridge domain with unicast routing enabled and a contract between the two EPGs that includes filters for the specified subnets.. ACI provides Layer 3 connectivity for EPGs through a bridge domain with unicast routing enabled, which allows the fabric to route between subnets. Policy between EPGs is enforced by contracts, and the contract subjects and filters define exactly which subnets or ports are permitted. Combining routed bridge domains with a filtered contract satisfies both the connectivity and the restriction requirements, with enforcement in hardware on the leaves.

Answer

A bridge domain with unicast routing disabled, so the EPGs are isolated at Layer 2.

Answer

A tenant with two EPGs in different bridge domains and no contract, relying on the default VRF to permit traffic.

Answer

A VRF with a contract between the two EPGs, allowing only the specified subnets.

Question 15

A network engineer is designing a Cisco SD-WAN solution using Cisco vManage. The engineer needs to ensure that the control plane is secure and that only authorized devices can join the overlay network. Which two components are used to authenticate and authorize devices in the Cisco SD-WAN control plane? (Choose two.)

Accepted Answer

Cisco vBond orchestrator. In Cisco SD-WAN, the vBond orchestrator and vSmart controller are responsible for authenticating and authorizing devices in the control plane. vBond acts as the initial point of authentication and orchestrates connections, while vSmart validates certificates and establishes control connections. vManage is for management, and ISE and DNA Center are not part of the SD-WAN control plane.

Answer

Cisco vManage

Answer

Cisco DNA Center

Answer

Cisco Identity Services Engine (ISE)