350-401 Virtualization Practice Test 4 — 15 Questions

Question 1

A network engineer is configuring a Cisco Nexus 9000 switch as part of a VXLAN EVPN fabric. The engineer wants to map VLAN 100 to VNI 10100 and ensure that the switch uses the NVE interface for VXLAN encapsulation. Which command must be configured under the NVE interface to associate VLAN 100 with VNI 10100?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

member vni 10100. To associate a VLAN with a VNI on a Cisco Nexus 9000 NVE interface, you first create the VNI member with member vni 10100, then within that mode use mapping vlan 100. This binds the VLAN to the VNI for VXLAN encapsulation. The other options are either invalid commands or incorrectly placed, and would not achieve the required mapping.

Answer

mapping vlan 100 vni 10100

Answer

vlan 100 vni 10100

Answer

vni 10100

Question 2

A network engineer is troubleshooting a Cisco ACI fabric. A tenant's bridge domain is configured with unicast routing enabled, but endpoints in the same subnet cannot communicate with each other, while endpoints in different subnets can. The bridge domain has an associated VRF and an SVI with a gateway address. What is the most likely cause?

Accepted Answer

The bridge domain is configured with ARP flooding disabled and no static ARP entries or endpoint learning, so endpoints cannot resolve each other's MAC addresses. In ACI, intra-subnet traffic relies on the fabric learning endpoint MAC addresses or on ARP resolution. If ARP flooding is disabled and endpoint learning is not supplying the bindings, endpoints cannot resolve each other and same-subnet communication fails, while routed traffic through the SVI continues to work. Contracts and shared subnets do not cause this specific pattern.

Answer

The bridge domain's subnet is configured as a shared subnet across VRFs, which disables intra-subnet forwarding

Answer

The bridge domain's unicast routing is enabled but the endpoint learning mode is set to disabled or the bridge domain is configured with hardware proxy, breaking local switching

Answer

The VRF associated with the bridge domain is missing an enforced contract between the two endpoints

Question 3

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The engineer needs to configure the underlay network to support VXLAN traffic. Which two statements are true regarding the underlay requirements for VXLAN EVPN? (Choose two.)

Accepted Answer

The underlay must provide IP reachability between VTEP loopback interfaces.. The underlay for VXLAN EVPN must provide IP reachability between VTEP loopback interfaces and support jumbo frames to handle the increased MTU due to VXLAN encapsulation. These are critical for establishing VXLAN tunnels and ensuring efficient data forwarding without fragmentation.

Answer

The underlay must provide a loop-free topology using a spanning-tree protocol.

Answer

The underlay must use a VLAN-based segmentation to isolate VXLAN traffic.

Answer

The underlay must run a multicast protocol such as PIM-SM for VXLAN flood-and-learn.

Question 4

A network engineer is deploying VXLAN EVPN on a Cisco Nexus 9000 switch. The engineer notices that the switch is not advertising EVPN Type-2 routes for a newly configured VNI. Which configuration step is most likely missing?

Accepted Answer

The VLAN is not mapped to the VNI under the NVE interface.. The most likely missing step is that the VLAN is not mapped to the VNI under the NVE interface. This mapping is required for the switch to generate EVPN Type-2 routes for that VNI. Without it, the switch does not associate the VLAN with the VNI, and thus does not advertise MAC/IP routes for that VNI.

Answer

The NVE interface is shut down.

Answer

The BGP EVPN address family is not activated under the router BGP configuration.

Answer

The VNI is not associated with an EVPN instance under the NVE interface.

Question 5

A network engineer is configuring a VRF on a Cisco IOS-XE router. The engineer wants to ensure that traffic from the VRF can reach the global routing table. Which feature should be configured?

Accepted Answer

Route leaking using static routes with the global keyword.. Route leaking using static routes with the global keyword is the correct method to allow traffic from a VRF to reach the global routing table. This configuration creates a static route in the VRF that points to a next-hop in the global table, enabling communication.

Answer

MP-BGP with address families.

Answer

VRF-aware NAT.

Answer

Policy-Based Routing (PBR).

Question 6

A network engineer is configuring a VRF on a Cisco IOS-XE router. The engineer wants to ensure that the VRF uses a separate routing table and that interfaces assigned to the VRF do not participate in the global routing table. Which command must be used to assign an interface to the VRF?

Accepted Answer

ip vrf forwarding VRF_NAME. To assign an interface to a VRF on a Cisco IOS-XE router, the `ip vrf forwarding VRF_NAME` command is used in interface configuration mode. This command places the interface's IP address into the specified VRF's routing table, isolating it from the global routing table. It is essential for VRF-Lite and MPLS VPN configurations. Without this command, the interface remains in the global table.

Answer

ip vrf VRF_NAME

Answer

vrf forwarding VRF_NAME

Answer

vrf definition VRF_NAME

Question 7

A cloud provider uses Cisco ACI to automate provisioning of tenant networks. A new tenant requires a Layer 2 bridge domain that extends to an external Layer 2 network via a VPC. The engineer creates a bridge domain with the settings: Type: Regular, L2 Unknown Unicast: Flood, L3 Unknown Multicast Flood: Flood, and Multi-Destination Flooding: Flood. The VPC is configured as a virtual port channel. The tenant reports that broadcast traffic is not reaching the external network. What is the most likely cause?

Accepted Answer

The L2Out is not configured to flood BUM traffic.. The bridge domain is configured to flood BUM (Broadcast, Unknown Unicast, and Multicast) traffic internally, but the L2Out (Layer 2 external connection) must also be explicitly configured to flood BUM traffic to the external network. Without this configuration on the L2Out, the ACI fabric will not forward broadcast or multicast frames across the VPC to the external Layer 2 network, even though the bridge domain itself permits flooding.

Answer

The VPC configuration does not support L2 extension.

Answer

The bridge domain is configured as proxy mode for L2 unknown unicast.

Answer

The bridge domain type should be set to 'L2 Only'.

Question 8

An engineer configures VXLAN EVPN on a Nexus 9000 switch. The configuration is shown. The switch does not advertise any EVPN routes for VNI 10100. Which configuration change is required to fix this issue?

Accepted Answer

Configure "evpn" and "vni 10100 l2" under the BGP address-family l2vpn evpn.. For VXLAN EVPN on a Nexus 9000, the BGP address-family l2vpn evpn must explicitly contain the 'evpn' keyword and the 'vni 10100 l2' command to advertise Layer 2 VNI routes. Without this configuration, BGP does not know to inject the VNI's MAC/VTEP information into the EVPN route table, so no EVPN routes are advertised for VNI 10100.

Answer

Remove the mcast-group from the NVE member, because EVPN uses BGP for control plane.

Answer

Change the source-interface to a physical interface.

Answer

Add an IP address to the VLAN 100 interface in the default VRF.

Question 9

Which TWO of the following are benefits of using network virtualization with VXLAN? (Choose two.)

Accepted Answer

Enables Layer 2 extension across Layer 3 boundaries.. VXLAN encapsulates Layer 2 frames in UDP packets over IP, allowing Layer 2 segments to be stretched across Layer 3 networks. This enables virtual machine mobility and multi-tenant environments without being constrained by physical network boundaries.

Answer

Eliminates the need for STP by using a centralized controller.

Answer

Uses only multicast for control plane learning.

Answer

Provides native encryption for data in transit.

Question 10

Which THREE of the following are components of a Cisco ACI fabric? (Choose three.)

Accepted Answer

Spine switch. The spine switch is a core component of a Cisco ACI fabric, forming the spine-leaf topology. Spine switches provide high-speed, non-blocking connectivity between leaf switches and handle all east-west traffic, relying on IS-IS as the routing protocol for fabric discovery and forwarding.

Answer

Firewall

Answer

Router

Question 11

A financial services company has deployed Cisco UCS servers with VMware vSphere 7.0 to host critical trading applications. The network uses Cisco Nexus 9000 switches in a VXLAN EVPN fabric with BGP as the underlay. The environment includes 50 ESXi hosts, each connected via two 40G interfaces to two different leaf switches in a VPC. The VMs are spread across multiple hosts and communicate over VXLAN. Recently, the operations team migrated a set of VMs from an old VLAN-based network to a new VXLAN segment (VNI 50000). After the migration, users report intermittent connectivity issues and packet loss. The engineering team captures traffic and notices that some VMs send ARP requests that are not being replied to, even though the target VM is active. Further analysis shows that the ARP requests are being flooded to all VTEPs, but the replies are not reaching the source. The team checks the underlay and finds no issues with BGP or routing. The NVE interfaces are up, and the VNI is configured. Which of the following is the most likely cause of the issue?

Accepted Answer

The MAC address of the target VM is not being advertised in EVPN type-2 routes because the VM's MAC is learned on a different leaf switch than expected.. The issue is that the target VM's MAC address is not being advertised via EVPN Type-2 routes from the leaf switch where it resides. When the source VM sends an ARP request, the ingress VTEP floods it to all VTEPs in the VNI's ingress replication list, but the reply from the target VM must be unicast back. If the target's MAC is not in the EVPN control plane (e.g., because it was learned on a different leaf than expected due to asymmetric MAC learning or stale entries), the reply cannot be forwarded correctly, causing intermittent connectivity.

Answer

The ingress replication list is missing some VTEPs.

Answer

The symmetric routing configuration is missing on the leaf switches.

Answer

The VPC configuration between the leaf switches and ESXi hosts is incorrect.

Question 12

A network engineer is troubleshooting connectivity issues in a multi-tenant environment where each tenant's traffic is isolated using VRF-Lite. The engineer notices that tenants in the same VRF cannot communicate with each other across different access switches. Which design change should be implemented to enable inter-switch VRF communication?

Accepted Answer

Create trunk links with 802.1Q subinterfaces on each switch and assign each subinterface to the appropriate VRF.. VRF-Lite requires 802.1Q trunking to extend Layer 3 VRF boundaries across switches. By creating subinterfaces on trunk links and assigning each subinterface to the appropriate VRF, traffic from the same VRF on different switches can be routed through the VRF-specific routing table, enabling inter-switch communication while maintaining isolation.

Answer

Use the same VLAN for all tenants and rely on VLAN ACLs.

Answer

Configure static routes on each switch pointing to the next-hop IP in the global routing table.

Answer

Enable OSPF with a single area on all switches and redistribute between VRFs.

Question 13

An organization is migrating from a traditional three-tier architecture to a leaf-spine fabric using VXLAN EVPN. The design requires that virtual machines can move between racks without IP address changes. Which technology must be enabled at the leaf switches to support this mobility?

Accepted Answer

VXLAN with EVPN control plane.. VXLAN with EVPN control plane (B) is correct because it provides a Layer 2 overlay network that extends VLANs across the leaf-spine fabric, enabling virtual machine mobility without IP address changes. EVPN uses BGP to distribute MAC and IP address information, allowing the leaf switches to learn and forward traffic to VMs regardless of their physical location, which is essential for seamless VM migration between racks.

Answer

Overlay Transport Virtualization (OTV).

Answer

VRF-Lite with route redistribution.

Answer

MPLS L3VPN with BGP.

Question 14

Which TWO statements correctly describe characteristics of virtual device contexts (VDCs) in Cisco Nexus switches?

Accepted Answer

Each VDC can have its own admin account and separate management interface.. Each VDC in a Cisco Nexus switch can be configured with its own administrative credentials and a dedicated management interface (e.g., mgmt0). This allows separate administrative domains and management access per VDC, which is a key feature for multi-tenant environments.

Answer

VDCs allow overlapping VLAN IDs across different VDCs only if using different VNIs.

Answer

VDCs provide Layer 3 routing isolation by default across all VDCs.

Answer

VDCs are supported on all Cisco IOS-XE switches.

Question 15

A network engineer configured VRF TENANT_A and moved the subinterfaces into the VRF. After the change, the CEF table shows the prefixes but the next-hop addresses are unreachable. What is the most likely cause?

Accepted Answer

The next-hop IP addresses are in the global routing table, not in the VRF.. When subinterfaces are moved into a VRF, the CEF table for that VRF will contain the learned prefixes, but the next-hop addresses must also be reachable within the same VRF. If the next-hop IP addresses reside in the global routing table instead of the VRF, the VRF will have no route to those next hops, causing them to be marked as unreachable. This is a common misconfiguration where the next-hop adjacency is not established within the VRF context.

Answer

LISP is not configured to map the virtual network.

Answer

OSPF is not redistributing the routes into the VRF.

Answer

The physical interface is not configured as a trunk.