350-401 Virtualization Practice Test 6 — 15 Questions

Question 1

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide secure segmentation for different departments without deploying separate physical networks or traditional VRFs on every switch. Which Cisco SD-Access component provides this segmentation by using a group-based policy model?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Scalable Group Tag (SGT). Cisco SD-Access uses Scalable Group Tags (SGTs) to implement group-based segmentation. Endpoints are assigned SGTs, and Security Group ACLs (SGACLs) enforce policy between groups. This approach provides micro-segmentation without the need for traditional VRFs on every switch, simplifying operations and improving security.

Answer

Access Control List (ACL)

Answer

VLAN pool

Answer

Virtual Routing and Forwarding (VRF)

Question 2

A network engineer is deploying virtual switching for a hypervisor host. The requirement is that virtual machines on the same host can communicate with each other using Layer 2 frame forwarding without any traffic leaving the physical NIC, and that VLAN tags be enforced per port profile. Which Cisco technology should be used to meet these requirements?

Accepted Answer

Cisco Nexus 1000V Virtual Ethernet Module (VEM). A virtual switch embedded in the hypervisor is needed so that same-host virtual machines exchange frames locally while still honoring VLAN and policy configuration. The Nexus 1000V VEM provides exactly this distributed virtual switching function, with the VSM supplying policy. The other listed products are virtual firewall, router and WAN optimization appliances, none of which perform virtual machine Layer 2 switching.

Answer

Cisco Adaptive Security Virtual Appliance (ASAv)

Answer

Cisco Virtual Wide Area Application Services (vWAAS)

Answer

Cisco Cloud Services Router 1000V (CSR 1000V)

Question 3

A network administrator is configuring a Cisco Nexus 9000 switch to participate in a VXLAN EVPN fabric. The administrator needs to define the source IP address used for VXLAN tunnels. Which interface should be configured as the source for the VXLAN tunnel?

Accepted Answer

A loopback interface with a /32 mask. The VXLAN tunnel source should be a loopback interface with a /32 mask. This ensures a stable, always-up source IP address that is independent of physical link failures. Using a physical interface, SVI, or port-channel can cause tunnel instability if the underlying links or VLANs go down.

Answer

A switched virtual interface (SVI) for the management VLAN

Answer

A physical uplink interface

Answer

A port-channel interface

Question 4

A network engineer is deploying a Cisco SD-Access fabric using Cisco DNA Center. The design requires that endpoints in the same virtual network (VN) be able to communicate even when they are attached to different fabric edge nodes. Which data plane technology does SD-Access use to carry the endpoint traffic across the fabric underlay?

Accepted Answer

VXLAN with a fabric VNI mapped to each virtual network. Cisco SD-Access uses VXLAN as the data plane encapsulation. Each virtual network is mapped to a unique VNI, and the fabric edge and border nodes encapsulate endpoint traffic in VXLAN. This allows endpoints in the same VN to communicate across different edge nodes while preserving segmentation. The control plane uses LISP to map endpoint identities to fabric locations.

Answer

MPLS L3VPN with a route target per virtual network

Answer

GRE with a tunnel key per virtual network

Answer

OTV with an overlay VLAN per virtual network

Question 5

A network engineer at a university is deploying Cisco HyperFlex to replace a legacy SAN-backed vSphere cluster. The design calls for fabric interconnects to be managed in Cisco UCS Manager, and the engineer wants the HyperFlex installer to fully configure the fabric interconnects and the UCS servers automatically. Which HyperFlex deployment model should the engineer choose?

Accepted Answer

HyperFlex standard cluster with fabric interconnects in UCS Manager-managed mode. Deploying a standard HyperFlex cluster with UCS Manager-managed fabric interconnects is the model in which the HyperFlex installer discovers and configures the fabric interconnects, server profiles, and networking automatically. Because the university wants full automation of fabric interconnect and UCS server configuration in a data-center cluster, the standard model is the only listed option that satisfies every stated requirement.

Answer

HyperFlex Edge with a two-node cluster managed by the HyperFlex Connect appliance

Answer

Cisco UCS Mini with HyperFlex software installed manually on each node

Answer

HyperFlex stretched cluster across two sites using Cisco Intersight-managed fabric interconnects

Question 6

A network engineer is configuring a Cisco IOS-XE router to support virtual routing and forwarding (VRF). The engineer wants to ensure that the VRF can be used for MPLS VPN and that the router can maintain separate routing tables. Which command is used to create a VRF named CUSTOMER?

Accepted Answer

vrf definition CUSTOMER. The correct command to create a VRF named CUSTOMER on a Cisco IOS-XE router is 'vrf definition CUSTOMER'. This command creates the VRF and enters VRF configuration mode, allowing the engineer to configure address families and other parameters. The 'ip vrf' command is an older alternative but lacks support for IPv6 and is not recommended for new deployments.

Answer

ip vrf CUSTOMER

Answer

interface vrf CUSTOMER

Answer

vrf CUSTOMER

Question 7

A network engineer is deploying a Cisco Nexus 9000 leaf switch in a VXLAN EVPN fabric. The underlay uses OSPF for loopback reachability, and the engineer must now enable the control plane that carries MAC and IP address reachability information for the overlay. Which technology must be enabled on the leaf switch to distribute this overlay reachability information?

Accepted Answer

MP-BGP with the Layer 2 EVPN address family. In a VXLAN EVPN fabric, the underlay (here OSPF) provides loopback-to-loopback reachability between VTEPs, while the overlay control plane is MP-BGP with the L2VPN EVPN address family. Enabling that address family allows the leaf to advertise MAC and IP address routes and VTEP membership through the spine route reflectors, replacing flood-and-learn with a scalable, standards-based control plane.

Answer

LISP with a Map-Server and Map-Resolver

Answer

OSPFv3 with the IPv6 unicast address family

Answer

PIM sparse mode with an Anycast-RP

Question 8

A network engineer is deploying Cisco ACI in a data center. The engineer needs to configure a bridge domain that provides Layer 2 connectivity between endpoints in the same tenant. Which two statements about Cisco ACI bridge domains are true? (Choose two.)

Accepted Answer

A bridge domain can contain multiple subnets.. In Cisco ACI, a bridge domain is a Layer 2 construct that can contain multiple subnets and must be associated with a VRF to enable Layer 3 routing. The VRF provides the routing context, and multiple subnets allow flexible IP addressing within the same bridge domain. VLAN pools are used for VLAN allocation but are not a direct requirement for the bridge domain itself.

Answer

A bridge domain requires a VLAN pool to be defined in the fabric access policies.

Answer

A bridge domain can only contain a single subnet.

Answer

A bridge domain provides Layer 3 routing between subnets by default.

Question 9

A network engineer is configuring a Cisco Nexus 9000 switch in a VXLAN EVPN fabric. The engineer wants to ensure that the switch can advertise MAC addresses learned from local hosts to other VTEPs. Which EVPN route type is used to advertise MAC address reachability information?

Accepted Answer

Type 2 - MAC/IP Advertisement route. In EVPN, MAC address reachability is advertised using Type 2 routes, also known as MAC/IP Advertisement routes. When a VTEP learns a local MAC address, it creates a Type 2 route containing the MAC address, the VNI, and the next-hop VTEP IP. This route is distributed via BGP EVPN to other VTEPs, enabling them to build the MAC-to-VTEP mapping for forwarding.

Answer

Type 3 - Inclusive Multicast Ethernet Tag route

Answer

Type 1 - Ethernet Auto-Discovery route

Answer

Type 5 - IP Prefix route

Question 10

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide secure segmentation for different departments without deploying separate physical networks or traditional VRFs on every switch. Which Cisco SD-Access component provides this segmentation by using a group-based policy model?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A contract between the tenant EPG and a shared services EPG in the common tenant. Cisco ACI enables selective inter-tenant communication by placing shared services in the common tenant and using contracts that are exported and consumed by tenant EPGs. This preserves Layer 3 isolation between tenants while permitting only the traffic defined by the contract. The shared services EPG can be a firewall or load balancer, and the contract enforces the allowed protocols and ports.

Answer

A VRF leak between the tenant VRFs using route targets

Answer

A bridge domain shared between tenants with a common subnet

Answer

A shared L3Out with a common EPG for all tenants

Question 11

A network administrator is deploying Cisco ACI in a data center. The administrator needs to ensure that a new tenant's application profile can communicate with an external Layer 2 network that is connected to a border leaf switch. Which ACI construct must be configured to extend the tenant's bridge domain to the external network?

Accepted Answer

A Layer 2 Outside (L2Out). To extend a Cisco ACI bridge domain to an external Layer 2 network, an L2Out must be configured. This construct defines the external bridged domain and network, and is applied to a border leaf interface. It allows Layer 2 traffic to pass between the ACI fabric and external devices, preserving VLAN tags or mapping them as needed.

Answer

A Layer 3 Outside (L3Out)

Answer

A VXLAN tunnel to the external switch

Answer

A bridge domain with a flood scope of 'external'

Question 12

A network engineer is configuring a Cisco Nexus 9000 switch in VXLAN EVPN mode. The engineer wants the leaf switch to advertise the local MAC addresses and IP addresses of hosts in a VLAN to remote leaf switches so that Layer 2 and Layer 3 forwarding can occur without flooding. Which EVPN route type must the engineer ensure is advertised for this purpose?

Accepted Answer

Type 2 MAC/IP Advertisement route. EVPN Type 2 MAC/IP Advertisement routes are the route type that carries host MAC addresses and, optionally, host IP addresses with the originating VTEP. Advertising them lets remote leaf switches program MAC and ARP/ND entries for known hosts, enabling unicast forwarding without flooding. Type 1, Type 3, and Type 5 routes serve different purposes and do not carry host reachability.

Answer

Type 3 Inclusive Multicast Ethernet Tag route

Answer

Type 1 Ethernet Auto-Discovery route

Answer

Type 5 IP Prefix route

Question 13

A data center team is designing a VXLAN EVPN fabric on Cisco Nexus 9000 switches to replace an aging three-tier topology. They want to understand which functions are performed by the VXLAN tunnel endpoints and the EVPN control plane. Which two statements accurately describe VXLAN EVPN behavior? (Choose two.)

Accepted Answer

VTEPs encapsulate original Layer 2 frames inside UDP packets destined to the remote VTEP IP address.. VXLAN encapsulates original frames in UDP and delivers them to a remote VTEP's IP address, while EVPN supplies a BGP-based control plane that distributes MAC and IP reachability so flooding is minimized. The underlay is routed, the VNI field is 24 bits wide, and each VTEP requires its own unique address, so the other statements misstate fundamental VXLAN EVPN design facts.

Answer

The VXLAN Network Identifier is a 12-bit field, limiting each fabric to 4094 segments.

Answer

VXLAN requires that the underlay fabric run only Layer 2 trunks between every leaf and spine.

Answer

VTEPs must be configured with the same IP address on every leaf switch to form a single tunnel endpoint.

Question 14

A network engineer is configuring a Cisco Catalyst 9000 switch to support a VXLAN EVPN fabric. The engineer wants to enable the switch to act as a VTEP and perform VXLAN encapsulation and decapsulation. Which command must be configured to create the VXLAN tunnel interface?

Accepted Answer

interface nve 1. To enable VXLAN on a Cisco switch, you must create an NVE interface using the 'interface nve 1' command. This interface is responsible for VXLAN encapsulation and decapsulation. Other interface types like tunnel, vxlan, or vlan do not provide VXLAN functionality.

Answer

interface vlan 1

Answer

interface tunnel 1

Answer

interface vxlan 1

Question 15

A network engineer is deploying a Cisco SD-Access fabric using Cisco DNA Center. The design requires that wired users authenticate via 802.1X and be assigned to a specific overlay segment based on their department. Which Cisco SD-Access fabric component is responsible for authenticating the endpoint and assigning the endpoint to the correct overlay?

Accepted Answer

Fabric edge node. In Cisco SD-Access, the fabric edge node is the device where endpoints connect and are authenticated. It uses 802.1X, MAC authentication bypass, or web authentication to verify identity and then assigns the endpoint to a virtual network based on the policy defined in Cisco DNA Center. The control plane node handles LISP mappings, and the border node handles external connectivity, so they do not perform the authentication and assignment role.

Answer

Cisco DNA Center

Answer

Fabric border node

Answer

Fabric control plane node