350-401 Virtualization Practice Test 8 — 15 Questions

Question 1

A network engineer is deploying a Cisco Nexus 9000 leaf-spine fabric with VXLAN EVPN. The design requires that all leaf switches act as VTEPs and that each leaf learn remote MAC addresses only from the fabric control plane rather than from data-plane flooding. Which configuration on the leaf switches accomplishes this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the NVE interface with `source-interface loopback0` and enable `host-reachability protocol bgp`.. The requirement is control-plane MAC learning across the VXLAN fabric. Binding the NVE interface to a loopback and enabling BGP as the host-reachability protocol makes the leaf a VTEP that exchanges EVPN MAC/IP and IMET routes with its peers. Remote MAC addresses are then resolved from BGP EVPN advertisements, eliminating flood-and-learn. Flooding, static ingress replication, and ARP suppression alone cannot satisfy that control-plane requirement.

Answer

Configure `arp suppression` on all leaf switches so that ARP requests are answered locally without control-plane involvement.

Answer

Configure `flooding enable` globally on each leaf so unknown unicast frames are replicated to all VTEPs in the fabric.

Answer

Configure `ingress-replication protocol static` on the NVE interface with a list of all remote VTEP addresses.

Question 2

A network engineer is deploying a VXLAN EVPN fabric with Cisco Nexus 9000 switches. The design requires that when a leaf switch learns a MAC address from a local host, remote leaf switches should be able to install that MAC into their forwarding tables without flooding. Which EVPN route type is used to advertise MAC address reachability?

Accepted Answer

Type 2 MAC/IP Advertisement route. EVPN Type 2 MAC/IP Advertisement routes are specifically designed to advertise host MAC and IP addresses along with the originating VTEP. Remote leaf switches receive these routes and program the MAC into their forwarding tables, enabling known unicast traffic to be sent directly without flooding. Other EVPN route types serve different purposes such as multihoming, BUM replication, or Layer 3 prefix advertisement.

Answer

Type 5 IP Prefix route

Answer

Type 3 Inclusive Multicast Ethernet Tag route

Answer

Type 1 Ethernet Auto-Discovery route

Question 3

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide Layer 3 isolation between different departments while allowing them to share the same physical network. Which Cisco SD-Access component is responsible for providing this isolation?

Accepted Answer

Virtual Network (VN). In Cisco SD-Access, Layer 3 isolation between departments is achieved by assigning them to different Virtual Networks (VNs). Each VN is essentially a separate VRF, and the fabric uses VXLAN with distinct VNIs to carry traffic for each VN. This allows the same physical infrastructure to support multiple isolated logical networks.

Answer

Locator/ID Separation Protocol (LISP)

Answer

Scalable Group Tag (SGT)

Answer

VXLAN Network Identifier (VNI)

Question 4

A network administrator is enabling a virtual routing and forwarding instance on a Cisco IOS-XE router to separate customer traffic. The administrator issues the ip vrf forwarding CUSTOMER_A command on Gi0/0/1, and the interface immediately loses its IP address. What is the reason for this behavior?

Accepted Answer

Assigning an interface to a VRF removes any previously configured IP address. On Cisco IOS-XE, entering the ip vrf forwarding command on an interface moves that interface into the named VRF and removes any IP address previously configured in the global table. The address must be reapplied afterward so the interface participates in the VRF's routing and forwarding tables. This is normal, expected behavior.

Answer

The router reloaded and lost the running configuration

Answer

The interface entered a shutdown state due to the VRF assignment

Answer

The VRF was not yet created in global configuration mode

Question 5

A network engineer is configuring a Cisco Catalyst 9000 switch to support a virtual routing and forwarding (VRF) instance for a guest network. The engineer wants to ensure that traffic from the guest VRF cannot leak into the corporate VRF. Which configuration step is required to maintain isolation between VRFs?

Accepted Answer

Place the guest network interfaces into the guest VRF and do not configure any route leaking.. VRFs provide logical separation of routing tables. When you assign interfaces to a VRF, those interfaces use that VRF's routing table. By default, there is no communication between VRFs unless you explicitly configure route leaking, such as static routes with next-hop VRF or BGP route targets. Therefore, placing the guest interfaces in the guest VRF and not configuring any route leaking ensures isolation. Other options either do not enforce isolation or are unnecessary.

Answer

Assign the guest VRF to a separate VLAN and configure inter-VLAN routing.

Answer

Configure a route target export and import policy to control route leaking.

Answer

Enable VRF-aware routing and ensure no static routes point between VRFs.

Question 6

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not advertising EVPN routes for a specific VNI. The NVE interface is up, and the VNI is configured. Which action should the engineer take to verify that the VNI is properly associated with the EVPN control plane?

Accepted Answer

Check the output of 'show bgp l2vpn evpn' to see if the VNI is advertised in the EVPN address family.. To verify that a VNI is properly associated with the EVPN control plane, the engineer should check the BGP EVPN table using 'show bgp l2vpn evpn'. This command displays EVPN routes, including those for the VNI. If the VNI is not advertised, it indicates a configuration issue in the EVPN address family or BGP. Other commands like 'show nve vni' or 'show interface nve1' do not directly show EVPN route advertisement.

Answer

Check the output of 'show vlan id 10' to see if VLAN 10 is active and mapped to the VNI.

Answer

Check the output of 'show interface nve1' to verify that the NVE interface is operational.

Answer

Check the output of 'show nve vni' to see if the VNI is up and associated with the NVE interface.

Question 7

An engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint in a spine-leaf fabric. The requirement is that the switch must perform VXLAN encapsulation and decapsulation in hardware without relying on the supervisor CPU, and it must support distributed anycast gateway for the tenant subnets. Which feature set must be enabled to meet these requirements?

Accepted Answer

Cisco NX-OS with the VXLAN feature and distributed anycast gateway enabled. Nexus 9000 switches support VXLAN encapsulation and decapsulation in hardware once the VXLAN feature is enabled, keeping forwarding off the supervisor CPU. A distributed anycast gateway configured with a shared virtual IP and MAC across leaf switches provides efficient first-hop routing for tenant subnets, meeting both requirements for this VXLAN Tunnel Endpoint design.

Answer

Traditional Layer 2 switching with STP

Answer

Cisco ACI with a fabric-wide VXLAN pool

Answer

Cisco Nexus Dashboard with fabric controller mode

Question 8

A network engineer is troubleshooting a Cisco Nexus 9000 leaf switch that is part of a VXLAN EVPN fabric. The engineer notices that the leaf is not learning remote MAC addresses, although the underlay is operational and BGP EVPN sessions are established. Which action should the engineer take to verify that the leaf is receiving EVPN Type 2 routes?

Accepted Answer

Check the output of 'show bgp l2vpn evpn' on the leaf.. To verify that the leaf is receiving EVPN Type 2 routes, you must examine the BGP EVPN table. The command 'show bgp l2vpn evpn' displays all EVPN routes, including Type 2 MAC/IP advertisement routes. If these routes are missing, the leaf will not learn remote MAC addresses. Other commands like 'show nve peers' show VTEP peers but not MAC routes, and 'show vxlan interface' shows tunnel configuration, not routes.

Answer

Check the output of 'show vxlan interface' on the leaf.

Answer

Check the output of 'show ip route' on the leaf.

Answer

Check the output of 'show nve peers' on the leaf.

Question 9

A network architect is designing a VXLAN EVPN fabric on Cisco Nexus 9000 switches to replace a traditional three-tier data center design. The architect wants to use a distributed anycast gateway so that hosts can move between leaf switches without changing their default gateway. Which two statements correctly describe the anycast gateway design? (Choose two.)

Accepted Answer

The same gateway IP and MAC address are configured on every leaf switch that hosts the VLAN. A distributed anycast gateway places the same virtual gateway IP and virtual MAC on every leaf switch that hosts the VLAN. Hosts keep a consistent default gateway no matter which leaf they attach to, and ARP is answered locally on the attached leaf. This supports seamless workload mobility and avoids stretching traffic to a central gateway.

Answer

Only the spine switches can host the anycast gateway function

Answer

Hosts must be reconfigured with a new default gateway each time they migrate

Answer

Each leaf switch must use a unique gateway MAC address to avoid duplicate MAC detection

Question 10

A network administrator is deploying Cisco ACI in a data center. The administrator must configure a bridge domain that allows Layer 2 connectivity between endpoints in the same tenant while also providing Layer 3 gateway services. The design requires that the bridge domain support both unicast routing and unknown unicast flooding. Which two settings must be enabled on the bridge domain to meet these requirements? (Choose two.)

Accepted Answer

Enable unicast routing on the bridge domain.. To provide Layer 3 gateway services, the bridge domain must have unicast routing enabled so it can route between subnets. To support unknown unicast flooding, the bridge domain must have unknown unicast flooding enabled. These two settings directly address the scenario's requirements, while other features like ARP flooding, IGMP snooping, and DHCP relay serve different purposes.

Answer

Enable DHCP relay on the bridge domain.

Answer

Enable IGMP snooping on the bridge domain.

Answer

Enable ARP flooding on the bridge domain.

Question 11

An engineer is configuring a VXLAN EVPN fabric on Cisco Nexus 9000 switches. VLAN 100 on leaf-1 must be mapped to VNI 10100, and the same Layer 2 segment must extend to leaf-2. The engineer creates VLAN 100 and enters the NVE interface configuration. Which configuration on leaf-1 correctly maps VLAN 100 to VNI 10100 so that the Layer 2 segment can be extended over the VXLAN overlay?

Accepted Answer

vlan 100 / vn-segment 10100 / interface nve1 / no shutdown / source-interface loopback0 / member vni 10100. Extending a VLAN over VXLAN on Nexus 9000 requires two coordinated pieces: the VLAN must be mapped to a VNI using vn-segment under the VLAN, and the NVE interface must include that VNI as a member with a valid source interface. The vn-segment command is what actually binds the Layer 2 segment to the VNI, while the NVE membership enables encapsulation. Omitting either piece leaves VLAN 100 local to leaf-1 and unable to reach leaf-2.

Answer

interface nve1 / no shutdown / source-interface loopback0 / member vni 10100 / ingress-replication protocol bgp

Answer

vlan 100 / vn-segment 10100 / interface nve1 / no shutdown / source-interface loopback0 / member vni 10100 / ingress-replication protocol static

Answer

interface nve1 / no shutdown / source-interface loopback0 / member vni 10100 / vlan 100

Question 12

A network administrator is configuring a Cisco IOS-XE router to support virtual routing and forwarding (VRF) for a customer. The administrator wants to ensure that traffic from the customer's VRF can reach the internet through a global routing table. Which feature should be configured to allow communication between the VRF and the global routing table?

Accepted Answer

Route leaking. Route leaking allows routes to be exchanged between VRFs, including the global routing table. By configuring route leaking, you can import routes from the global table into the VRF and export routes from the VRF to the global table. This enables communication between the VRF and the global table, allowing traffic to reach the internet. Other features like NAT or MPLS L3VPN do not provide this local routing capability.

Answer

VXLAN EVPN

Answer

VRF-aware NAT

Answer

MPLS Layer 3 VPN

Question 13

A network engineer is configuring a Cisco Nexus 9000 switch as a VTEP in a VXLAN EVPN fabric. The engineer wants to ensure that the switch uses the loopback0 interface as the source for VXLAN tunnels and that it can dynamically learn remote VTEPs via BGP EVPN. Which command set is required under the NVE interface?

Accepted Answer

interface nve1; source-interface loopback0; host-reachability protocol bgp. For a Cisco Nexus 9000 VTEP in an EVPN fabric, the NVE interface must be configured with source-interface loopback0 to set the tunnel source IP and host-reachability protocol bgp to enable dynamic learning of remote VTEPs and MAC addresses via BGP EVPN. Other commands like no shutdown are necessary but insufficient, and static peer-ip or IP address under NVE is incorrect.

Answer

interface nve1; source-interface loopback0; vni 10000; ip address 10.0.0.1/32

Answer

interface nve1; source-interface loopback0; no shutdown

Answer

interface nve1; source-interface loopback0; peer-ip 10.0.0.2

Question 14

A network architect is evaluating Cisco SD-WAN to connect branch offices to data centers and public cloud workloads. The architect wants to understand which capabilities are provided by the Cisco SD-WAN solution. (Choose two.)

Accepted Answer

Centralized policy management through vManage with templates pushed to edge devices. Cisco SD-WAN delivers application-aware routing that continuously measures path quality and steers traffic per policy, and it centralizes configuration and policy in vManage for scalable provisioning. These two capabilities align with the architect's goal of optimizing and managing branch-to-data-center and cloud connectivity across multiple transports.

Answer

Replacement of all branch routing with static routes only

Answer

Elimination of all encryption on the overlay tunnels

Answer

Mandatory use of MPLS as the only WAN transport

Question 15

A network engineer is troubleshooting a Cisco Nexus 9000 leaf switch in a VXLAN EVPN fabric. Hosts in VLAN 200 on one leaf cannot reach hosts in VLAN 200 on a remote leaf, although the Type 2 routes are present in the EVPN table. The engineer confirms that the local VTEP address is correct. Which action should the engineer take to verify that the VNI is properly mapped to the VLAN and that traffic is placed into the correct overlay?

Accepted Answer

Run show vxlan vni to confirm the VNI-to-VLAN mapping and check the VXLAN interface state. The show vxlan vni command reveals the VLAN-to-VNI bindings and the state of the VXLAN interface, which is exactly what must be validated when hosts in the same VLAN cannot communicate across leaves despite EVPN routes being present. Routing table, EVPN table, and NVE interface checks address different layers and do not confirm the overlay mapping for VLAN 200.

Answer

Run show ip route vrf all to confirm that the tenant prefixes are installed in the routing table

Answer

Run show bgp l2vpn evpn to confirm that the Type 2 routes are received from the remote leaf

Answer

Run show interface nve1 to confirm that the NVE interface is administratively up and has the correct source address