350-401 Virtualization Practice Test 9 — 15 Questions

Question 1

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not learning remote MAC addresses from the EVPN control plane. The underlay is OSPF, and BGP EVPN peering is established with the spine switches. Which command should the engineer use to verify that the switch is receiving EVPN Type-2 routes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

show bgp l2vpn evpn. To verify that the switch is receiving EVPN Type-2 routes, the engineer should use 'show bgp l2vpn evpn'. This command displays the BGP EVPN table, where Type-2 routes appear as '[2]:[MAC/IP]' entries. If these routes are missing, the switch will not learn remote MAC addresses via EVPN. Checking the BGP EVPN table is the first step in troubleshooting control-plane learning issues.

Answer

show ip route vrf all

Answer

show l2route evpn mac all

Answer

show nve peers

Question 2

A network architect is designing a Cisco SD-Access fabric. The requirement is to provide segmentation for different user groups (employees, guests, contractors) while allowing them to share the same physical infrastructure. Which Cisco SD-Access component is responsible for enforcing group-based policies between endpoints?

Accepted Answer

Fabric Edge Node. In Cisco SD-Access, segmentation is achieved through the use of Scalable Group Tags (SGTs) and SGACLs. The fabric edge nodes are the enforcement points where SGACLs are applied. When an endpoint sends traffic, the edge node adds the source SGT to the VXLAN header. The destination edge node uses the source and destination SGTs to apply the correct SGACL. This allows different user groups to be segmented even when using the same physical infrastructure. ISE assigns SGTs, but enforcement is at the edge.

Answer

Identity Services Engine (ISE)

Answer

Control Plane Node (CP Node)

Answer

Fabric Border Node

Question 3

A network architect is evaluating VXLAN as the data plane encapsulation for a new data center fabric. Which two statements accurately describe how VXLAN operates? (Choose two.)

Accepted Answer

VXLAN encapsulates original Layer 2 frames inside UDP datagrams sent to destination port 4789.. VXLAN encapsulates original Layer 2 frames in UDP datagrams destined for port 4789 and identifies each logical segment with a 24-bit VNI supporting about 16 million segments. These two properties let the fabric scale far beyond VLAN limits while running over a routed Layer 3 underlay between distinct VTEP addresses.

Answer

VXLAN replaces the original Ethernet header with a new one and discards the original source MAC.

Answer

VXLAN tunnel endpoints must use the same IP address to form a tunnel.

Answer

VXLAN requires the underlay to be a single Layer 2 domain with no routing between VTEPs.

Question 4

A network engineer is configuring a VRF on a Cisco IOS-XE router to isolate a customer's traffic. The engineer creates VRF CUST_A, assigns the customer-facing interface to it, and runs the show ip route vrf CUST_A command, which returns no routes. The interface is up and the customer router is reachable. What is the most likely cause?

Accepted Answer

The interface was placed in the VRF, but no IP address or routing protocol was configured on that interface within the VRF.. A VRF routing table is populated by connected routes from interfaces that both belong to the VRF and have IP addresses, plus any static routes or dynamic routing configured inside the VRF address family. If the interface was moved into the VRF but never addressed, or if no routing protocol or static route was configured within the VRF, the table stays empty. Verifying the interface address and the VRF's routing configuration explains the symptom.

Answer

The ip vrf forwarding command must be applied to the VRF definition rather than to the interface.

Answer

The VRF was created but no route distinguisher or route target was configured, which is required for any VRF to install routes.

Answer

The global routing table must be cleared with the clear ip route * command before VRF routes will appear.

Question 5

A network engineer is configuring a Cisco CSR 1000v router in a virtualized environment. The engineer needs to ensure that the router can forward traffic between multiple virtual routing and forwarding (VRF) instances while maintaining isolation. Which technology should the engineer use to allow communication between specific VRFs?

Accepted Answer

VRF leaking. VRF leaking is the correct technology because it allows specific routes to be imported from one VRF into another, enabling controlled communication while preserving isolation. This is typically done using route targets and route maps. Other options like GRE tunneling or policy-based routing can be used in specific cases but are not the standard method for inter-VRF communication on a single router.

Answer

Policy-based routing

Answer

VLAN trunking

Answer

GRE tunneling

Question 6

A network engineer is deploying a virtualized branch solution using Cisco Enterprise Network Function Virtualization Infrastructure Software (NFVIS). The goal is to run multiple virtual network functions such as a virtual router and a virtual firewall on a single Cisco UCS E-Series or C-Series server at the branch. Which statement accurately describes how NFVIS supports this deployment?

Accepted Answer

NFVIS provides a hypervisor and lifecycle management for hosting multiple VNFs on the branch server. Cisco NFVIS is a KVM-based virtualization platform that supplies the hypervisor, VM lifecycle management, and orchestration needed to run multiple virtual network functions on a single branch server. This enables consolidating a virtual router, virtual firewall, and other services at the branch, which matches the engineer's deployment goal.

Answer

NFVIS replaces the need for any hypervisor by running VNFs directly on bare metal without virtualization

Answer

NFVIS only supports a single VNF per physical server and cannot host multiple virtual machines

Answer

NFVIS is a cloud-only orchestration tool that cannot run on branch appliances

Question 7

A company is consolidating branch servers onto a single physical host running a hypervisor. The administrator needs each virtual machine to have its own virtual NIC with an independent MAC address and to be isolated at Layer 2 from other virtual machines unless explicitly connected to the same virtual switch. Which component provides this function?

Accepted Answer

The virtual switch inside the hypervisor. The virtual switch is the hypervisor component that gives each virtual machine a virtual NIC and forwards frames between them, enforcing isolation between port groups unless they are connected. The physical switch and trunk only carry traffic once it leaves the host, and the virtual machine monitor handles resource scheduling rather than Layer 2 forwarding.

Answer

The hypervisor's virtual machine monitor alone

Answer

The physical top-of-rack switch

Answer

A VLAN trunk configured on the physical NIC

Question 8

A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The engineer must configure the NVE interface and ensure proper VXLAN data plane operation. Which two statements about VXLAN EVPN configuration on Nexus 9000 are true? (Choose two.)

Accepted Answer

The EVPN control plane requires BGP to be configured with the EVPN address family on the spine and leaf switches.. The NVE interface requires a reachable source interface for VXLAN tunnels to form, and the EVPN control plane relies on BGP with the EVPN address family to exchange MAC and IP reachability information. These two statements are true for VXLAN EVPN configuration on Nexus 9000. The other options are either general VXLAN facts not specific to EVPN configuration, incorrect requirements, or applicable only to flood-and-learn VXLAN.

Answer

VXLAN uses a 24-bit VNI field, allowing for up to 16 million unique VNIs.

Answer

Each VNI must be mapped to a unique VLAN on every leaf switch in the fabric.

Answer

The NVE interface must be configured with a multicast group for broadcast, unknown unicast, and multicast (BUM) traffic.

Question 9

A network architect is designing a data center fabric that uses VXLAN with an EVPN control plane on Cisco Nexus 9000 switches. The architect must justify why EVPN is preferred over a flood-and-learn VXLAN data plane. Which two statements correctly describe advantages of using an EVPN control plane in this design? (Choose two.)

Accepted Answer

It distributes MAC address reachability through BGP so VTEPs do not need to flood frames to learn remote host locations. An EVPN control plane advertises MAC and IP reachability via BGP, avoiding data-plane flooding for host learning, and it supports standards-based all-active multihoming through Ethernet Segment identifiers and DF election. It does not remove the underlay routing requirement, convert VXLAN to MPLS, or eliminate the VTEP loopback, so those statements are incorrect for this design.

Answer

It converts VXLAN tunnels into MPLS LSPs to improve forwarding performance between leaf switches

Answer

It eliminates the need for any underlay routing protocol because BGP carries all traffic between leaf switches

Answer

It removes the requirement for a loopback interface on each VTEP by using physical interface addresses

Question 10

A network engineer is troubleshooting a Cisco Nexus 9000 switch configured with VXLAN EVPN. The engineer notices that the switch is not learning remote MAC addresses from the EVPN control plane. The underlay is OSPF, and BGP EVPN peering is established with the spine switches. Which command should the engineer use to verify that the switch is receiving EVPN Type-2 routes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The two leaf switches must establish a BGP EVPN session, either directly or through a route reflector, and exchange MAC or MAC-IP routes for the VNI.. For hosts in the same subnet on different leaves to communicate, the fabric needs both control-plane and data-plane reachability. The EVPN session must advertise the type-2 MAC or MAC-IP routes for the VNI so each leaf learns the remote VTEP for the destination, and the underlay must be able to deliver encapsulated packets to that remote VTEP IP. Missing either element leaves the VNI up but the hosts unable to reach each other.

Answer

The spines must terminate the VXLAN tunnels and perform the inter-VTEP forwarding between the two leaf switches.

Answer

The two leaf switches must use the same VLAN ID locally for the segment, because the VLAN ID is carried inside the VXLAN header.

Answer

The two leaf switches must have identical bridge domain configurations, including the same anycast gateway MAC address on every leaf.

Question 11

A network engineer is configuring a Cisco CSR 1000v router to support a virtual routing and forwarding (VRF) instance for a customer. The engineer wants to enable OSPFv2 within the VRF and ensure that OSPF routes are installed in the VRF's routing table. Which command is required to start the OSPF process for the VRF?

Accepted Answer

router ospf 1 vrf CUSTOMER. The correct command to enable OSPFv2 in a VRF on Cisco IOS-XE is 'router ospf vrf '. This associates the OSPF process with the specified VRF, allowing it to run in that VRF's routing context. The other options either use incorrect syntax or are appropriate for different platforms or protocols.

Answer

ip router ospf 1 vrf CUSTOMER

Answer

router ospf 1
 address-family ipv4 vrf CUSTOMER

Answer

router ospf 1
 vrf CUSTOMER

Question 12

A network engineer is configuring NTP authentication on a Cisco IOS-XE router. The goal is to ensure the router only synchronizes with a trusted NTP server and that the server's keys are validated. Which sequence of configuration steps correctly enforces authenticated NTP peering?

Accepted Answer

Enable `ntp authenticate`, define the key with `ntp authentication-key 1 md5 `, mark it trusted with `ntp trusted-key 1`, then add `ntp server key 1`.. Enforcing authenticated NTP requires four coordinated elements: the global `ntp authenticate` command, a defined authentication key with its MD5 value, a `ntp trusted-key` statement for that key number, and the key reference on the `ntp server` command. Missing any one element breaks the chain, either by leaving authentication disabled, by rejecting valid packets, or by failing to associate the key with the specific peer.

Answer

Define the key with `ntp authentication-key 1 md5 ` and add `ntp server key 1`, omitting `ntp authenticate` because the server command implies authentication.

Answer

Enable `ntp authenticate` and mark the key trusted with `ntp trusted-key 1`, but do not configure the key value itself, relying on the server to supply it.

Answer

Configure `ntp master 1` on the router and add `ntp server <ip>`, because a stratum 1 master enforces authentication automatically.

Question 13

A network engineer is configuring a Cisco IOS-XE router to support virtual routing and forwarding (VRF) for a multi-tenant environment. The engineer wants to ensure that traffic from each tenant is isolated and that overlapping IP addresses can be used. Which command is used to create a VRF instance and enter VRF configuration mode?

Accepted Answer

vrf definition TENANT_A. The correct command to create a VRF instance on a Cisco IOS-XE router is 'vrf definition TENANT_A'. This command creates the VRF and enters VRF configuration mode, where route distinguishers and route targets can be configured. The 'ip vrf' command is legacy and not recommended on IOS-XE. The 'vrf forwarding' and 'ip vrf forwarding' commands are used on interfaces to assign them to an existing VRF, not to create one.

Answer

vrf forwarding TENANT_A

Answer

ip vrf forwarding TENANT_A

Answer

ip vrf TENANT_A

Question 14

An engineer is configuring a Cisco Nexus 9000 switch running VXLAN EVPN. Tenant traffic must be encapsulated with a VXLAN header that includes a 24-bit VNI, and the underlay must provide loopback-based VTEP addressing with ECMP. The engineer notices that the switch is not forming VXLAN tunnels to remote leaf switches. Which configuration issue is the most likely cause?

Accepted Answer

The NVE interface is missing the source-interface loopback and the VNI-to-VLAN mapping is incomplete. VXLAN tunnel formation on a Nexus 9000 requires the NVE interface to have a source-interface, usually a loopback, and correct VNI-to-VLAN mappings. Without a valid VTEP source address or with incomplete VNI mappings, the switch cannot establish tunnels to remote leaf VTEPs, which matches the observed failure.

Answer

The switch is using a 12-bit VLAN ID instead of the required 24-bit VNI in the VXLAN header

Answer

The underlay is running OSPF instead of BGP, which prevents VXLAN tunnel establishment

Answer

The switch is configured with VXLAN VNI 16777216, which exceeds the 24-bit range

Question 15

A network engineer is configuring a Cisco Nexus 9000 switch as a VXLAN Tunnel Endpoint. The engineer needs to define the source interface used for the VXLAN tunnels and map VLANs to a VNI. Which command sequence accomplishes this?

Accepted Answer

feature nv overlay, interface nve1, source-interface loopback1, member vni 10000, then under interface Vlan100 configure vn-segment 10000. On Nexus 9000 NX-OS, VXLAN configuration requires enabling the NV overlay feature, creating interface nve1, specifying the loopback as the tunnel source, adding the VNI as a member, and mapping the VLAN to the VNI with vn-segment under the VLAN interface. The other options misplace commands or use syntax from other platforms.

Answer

interface nve1, then source-interface loopback1, then member vni 10000 associated-vrf tenant1

Answer

interface nve1, then source-interface loopback1, then member vni 10000, then vlan 100 under the VNI

Answer

interface vxlan1, then source-interface loopback1, then vni 10000 vlan 100 mapping