350-401 VRF and Path Isolation Practice Test 1 — 15 Questions

Question 1

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE PE router. The engineer creates a VRF named CUSTOMER_A with route-target import and export 100:1. After configuring the VRF on the interface connected to the CE router, the CE router can ping the PE's VRF interface IP, but cannot reach any remote VPNv4 routes. The BGP session between PE and route reflector is up. What is the most likely cause?

Accepted Answer

The VRF is not activated under BGP using the address-family ipv4 vrf CUSTOMER_A command.. The CE router can ping the PE's VRF interface IP, confirming Layer 2 and VRF interface configuration are correct. However, the CE cannot reach remote VPNv4 routes, which indicates that the PE is not advertising or installing those routes into the VRF. The most likely cause is that the VRF CUSTOMER_A has not been activated under BGP using the 'address-family ipv4 vrf CUSTOMER_A' command, which is required to exchange IPv4 routes between the PE and CE within the VRF context and to redistribute them into MP-BGP for VPNv4 propagation.

Answer

The route-target import/export values are mismatched with the route reflector's configuration.

Answer

The CE router is not configured with a default route pointing to the PE.

Answer

The PE router needs the mpls ip command on the interface facing the CE router.

Question 2

An enterprise uses VRF-lite to isolate guest Wi-Fi traffic from corporate traffic on a Cisco Catalyst 9300 switch. The guest VRF (GUEST) is configured on VLAN 100, and the corporate VRF (CORP) on VLAN 200. Both VRFs use the same default gateway router connected via a trunk. The engineer notices that guest devices can reach the internet but cannot access the guest captive portal hosted on a server in VLAN 100. The server's IP is reachable from the switch itself. What is the issue?

Accepted Answer

The guest server is in a different VLAN than the guest wireless subnet, and inter-VLAN routing is not configured within the GUEST VRF.. The issue is that the guest captive portal server resides in VLAN 100, but the guest wireless subnet is likely in a different VLAN or subnet within the GUEST VRF. Since VRF-lite provides separate routing tables, inter-VLAN routing within the same VRF must be explicitly configured (e.g., using SVIs with 'ip routing' and proper VRF forwarding). The switch can reach the server because it is directly connected, but guest devices cannot because their traffic is not routed between the wireless subnet and the server's VLAN within the GUEST VRF.

Answer

The trunk between the switch and the router is not allowing VLAN 100.

Answer

The guest VRF is missing the route-target export command.

Answer

The captive portal server is configured with a default gateway that points to the corporate VRF.

Question 3

A service provider uses MPLS L3VPN with multiple VRFs on a Cisco ASR 1000 PE router. One customer VRF (RED) has overlapping IP addresses with another VRF (BLUE). The engineer configures route-target import/export as 100:1 for RED and 200:2 for BLUE. Both VRFs have a static default route pointing to the CE. The PE receives VPNv4 routes from the route reflector for both VRFs. However, traffic from RED to its CE is working, but traffic from BLUE to its CE is intermittently failing. What is the most likely cause?

Accepted Answer

The BLUE VRF's interface is not configured with the ip vrf forwarding BLUE command, so the interface is in the global routing table.. The correct answer is A because if the BLUE VRF's interface is missing the 'ip vrf forwarding BLUE' command, the interface remains in the global routing table. This means traffic from the BLUE VRF will be forwarded using the global routing table instead of the VRF's routing table, causing intermittent failures when the global table does not have a route to the CE or when the CE's IP overlaps with another VRF's subnet. The static default route configured in the BLUE VRF would not be used, leading to connectivity issues.

Answer

The route-target import for BLUE is 200:2, but the route reflector exports routes with a different route-target.

Answer

The PE router has too many VRFs, causing memory exhaustion.

Answer

The BLUE VRF is missing the rd command.

Question 4

A network engineer is troubleshooting a VRF-lite deployment on a Cisco Nexus 9000 switch. Two VRFs, PROD and DEV, are configured. The switch has an SVI for VLAN 10 in VRF PROD and VLAN 20 in VRF DEV. A firewall is connected to a Layer 3 port in VRF PROD for internet access. The engineer needs to allow the DEV VRF to reach the internet through the same firewall, but without using a separate physical interface. What should the engineer configure?

Accepted Answer

Configure a static route in VRF DEV pointing to the firewall's IP address in VRF PROD, and use the route-map to leak the route.. Option A is correct because VRF-lite does not support direct route leaking between VRFs without an external mechanism. By configuring a static route in VRF DEV pointing to the firewall's IP address (which resides in VRF PROD) and using a route-map to leak the route, the engineer enables inter-VRF routing. This allows DEV traffic to reach the firewall's interface in PROD without requiring a separate physical interface, as the route-map controls which prefixes are shared between VRFs.

Answer

Place the firewall interface in both VRFs using the ip vrf forwarding command on the same interface.

Answer

Create a VLAN trunk between the switch and firewall, and assign the same VLAN to both VRFs.

Answer

Use policy-based routing (PBR) in VRF DEV to forward traffic to the firewall's MAC address.

Question 5

An engineer is configuring MPLS L3VPN on a Cisco IOS-XR router. The VRF CUSTOMER_B is configured with route-target import 100:1 and export 100:1. The engineer notices that the VRF routes are not being advertised to the route reflector. The BGP session to the route reflector is established and the VPNv4 address family is activated. What is the missing configuration?

Accepted Answer

The engineer did not configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and redistribute the routes.. Option B is correct because in MPLS L3VPN on Cisco IOS-XR, simply configuring the VRF and establishing the BGP VPNv4 session is insufficient. The engineer must explicitly configure the address-family ipv4 unicast vrf CUSTOMER_B under BGP and use the redistribute command (e.g., redistribute connected or redistribute static) to inject the VRF routes into BGP for advertisement to the route reflector. Without this, the VRF routes remain in the local routing table but are never converted into VPNv4 prefixes.

Answer

The VRF is not configured with a route distinguisher.

Answer

The route-target import/export values are incorrect.

Answer

The interface in the VRF is not configured with the ipv4 address.

Question 6

A company uses VRF-lite to separate management traffic (VRF MGMT) from user traffic (VRF USER) on a Cisco Catalyst 3850 stack. The management network is 10.0.0.0/24, and the user network is 192.168.1.0/24. The engineer wants to allow SSH access from the user network to the management network for device administration. The switch has an SVI for each VRF. What is the simplest way to achieve this while maintaining VRF isolation?

Accepted Answer

Configure a static route in VRF USER pointing to the VRF MGMT's SVI IP address, and enable route leaking between the VRFs.. Option A is correct because VRF-lite inherently isolates routing tables, so to allow SSH from VRF USER to VRF MGMT while maintaining isolation, you must leak routes between the VRFs. A static route in VRF USER pointing to the VRF MGMT SVI IP address, combined with route leaking (e.g., using `route-map` and `import/export` commands), enables the necessary reachability without merging the VRFs. This is the simplest method as it avoids additional hardware or complex configurations.

Answer

Place both SVIs in the same VRF and use access-lists to restrict traffic.

Answer

Use a firewall between the VRFs to filter traffic.

Answer

Configure the switch to use the global routing table for SSH traffic only.

Question 7

A network engineer is configuring MPLS L3VPN on a Cisco IOS-XE router. The VRF CUSTOMER_C has route-target import 300:1 and export 300:1. The PE receives VPNv4 routes from the route reflector, but the CE router connected to the PE cannot ping any remote site IP addresses. The PE can ping the remote site IP addresses from the VRF. What is the most likely cause?

Accepted Answer

The CE router does not have a default route pointing to the PE's VRF interface.. The PE can ping remote site IP addresses from within the VRF, confirming that the VRF has the correct route-target import/export configuration and that VPNv4 routes are being received and installed in the VRF routing table. However, the CE router cannot ping remote sites, which indicates that the CE does not have a route pointing to the PE’s VRF interface as its next hop. Without a default route or a specific route pointing to the PE’s VRF-facing interface, the CE has no path to forward traffic to remote VPN destinations, even though the PE can reach them.

Answer

The VRF is missing the route-target export command.

Answer

The PE router is not running a routing protocol with the CE router.

Answer

The MPLS LDP is not enabled on the PE-CE link.

Question 8

An enterprise uses VRF-lite on a Cisco Catalyst 9300 to isolate a guest network (VRF GUEST) from the corporate network (VRF CORP). The guest network uses DHCP from a server in the corporate network. The engineer configures a DHCP relay on the guest SVI pointing to the corporate DHCP server. The DHCP server is in VRF CORP. The guest clients are not receiving IP addresses. What is the issue?

Accepted Answer

The DHCP server is in a different VRF, and the switch does not have a route from the GUEST VRF to the CORP VRF for the DHCP server.. The DHCP server resides in VRF CORP, but the DHCP relay agent on the guest SVI forwards the discover packet within VRF GUEST. Without a route from VRF GUEST to the DHCP server's subnet in VRF CORP, the relayed packet cannot reach the server. Inter-VRF routing (e.g., a route leak or VRF-aware service) is required for the relay to forward the packet across VRFs.

Answer

The DHCP relay agent is not configured to use the VRF GUEST; the ip helper-address command must be applied under the VRF interface, but the DHCP server is in a different VRF, requiring inter-VRF routing or the use of the ip dhcp relay information option.

Answer

The DHCP server is not configured with a scope for the guest subnet.

Answer

The guest VRF is missing the ip dhcp relay command globally.

Question 9

A service provider is migrating a customer from a global routing table to a VRF on a Cisco ASR 1000. The customer has a BGP session with the provider for internet access. After moving the customer's interface to VRF CUSTOMER_D, the BGP session goes down. The engineer verifies that the VRF is configured with the correct route-target and that the BGP neighbor is configured under address-family ipv4 vrf CUSTOMER_D. What else is missing?

Accepted Answer

The IP address on the interface was removed when the VRF was applied, and it was not reconfigured.. When a VRF is applied to an interface on a Cisco ASR 1000, the interface's IP address is removed because the VRF changes the routing context. The engineer must reconfigure the IP address under the VRF interface. Without the IP address, the BGP session cannot establish a TCP connection, causing it to go down.

Answer

The BGP neighbor is not configured with the password command.

Answer

The route-target import/export values are incorrect for the customer.

Answer

The engineer forgot to configure the VRF under the BGP router-id.

Question 10

A network engineer runs the following command on Router R1:

R1# show ip route vrf CUSTOMER-A

VRF CUSTOMER-A:
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.1.1 to network 0.0.0.0

10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.0.0.0/30 is directly connected, GigabitEthernet0/0.100
L        10.0.0.1/32 is directly connected, GigabitEthernet0/0.100
B        10.0.2.0/24 [200/0] via 192.168.1.2, 00:12:34

Based on this output, what can be concluded?

Accepted Answer

VRF CUSTOMER-A has a BGP-learned route to 10.0.2.0/24. The output shows a BGP-learned route to 10.0.2.0/24 with the code 'B' and the administrative distance [200/0], indicating it is an external BGP route. The route is installed in the VRF CUSTOMER-A routing table, confirming that VRF CUSTOMER-A is using BGP and has learned this prefix via BGP from the next-hop 192.168.1.2.

Answer

VRF CUSTOMER-A is not using BGP for routing

Answer

The default route is learned via BGP

Answer

GigabitEthernet0/0.100 is not associated with VRF CUSTOMER-A

Question 11

A network engineer runs the following command on Router R2:

R2# show vrf detail

VRF CUSTOMER-B (VRF Id = 1); default RD 65000:1; default VPNID <not set>
  Interfaces:
           GigabitEthernet0/0.200
           GigabitEthernet0/1.200
  Address family IPV4 unicast:
    Export VPN route-target communities:
      RT:65000:100
    Import VPN route-target communities:
      RT:65000:100
    No export route-map
    No import route-map
  Address family IPV6 unicast:
    Export VPN route-target communities:
      RT:65000:100
    Import VPN route-target communities:
      RT:65000:100
  Members:
    10.0.0.0/24

Based on this output, what can be concluded?

Accepted Answer

The VRF supports both IPv4 and IPv6 VPNs with matching route-targets. The output shows both 'Address family IPV4 unicast' and 'Address family IPV6 unicast' sections, each with the same export and import route-target communities (RT:65000:100). This confirms the VRF CUSTOMER-B supports both IPv4 and IPv6 VPN address families with matching route-targets, enabling MPLS L3VPN services for both address families over the same VRF.

Answer

The VRF is configured for IPv4 only

Answer

The VRF uses different route-targets for import and export

Answer

The VRF has no interfaces assigned

Question 12

A network engineer runs the following command on Router R3:

R3# show bgp vpnv4 unicast all summary

BGP router identifier 10.0.0.3, local AS number 65000
BGP table version is 10, main routing table version 10
10 network entries using 1440 bytes of memory
10 path entries using 1360 bytes of memory
6/5 BGP path/bestpath attribute entries using 840 bytes of memory
4 BGP AS-PATH entries using 112 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 3752 total bytes of memory
BGP activity 20/10 prefixes, 20/10 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
192.168.1.1     4        65000    1000    1000       10    0    0 01:23:45        5
192.168.2.2     4        65000     800     800       10    0    0 00:45:12        3

Based on this output, what can be concluded?

Accepted Answer

Both neighbors are iBGP peers exchanging VPNv4 prefixes. The command `show bgp vpnv4 unicast all summary` displays BGP VPNv4 unicast summary information for all VRFs. Both neighbors (192.168.1.1 and 192.168.2.2) are in the same AS 65000, and the output shows they are exchanging VPNv4 prefixes (State/PfxRcd shows 5 and 3 prefixes received). This confirms they are iBGP peers within the same AS, specifically for VPNv4 address family, which is used in MPLS Layer 3 VPN environments to carry customer VPN routes.

Answer

Both neighbors are eBGP peers

Answer

The neighbor 192.168.1.1 is not receiving any prefixes

Answer

The BGP table has 20 prefixes

Question 13

A network engineer runs the following command on Router R4:

R4# show mpls ldp neighbor vrf CUSTOMER-C

Peer LDP Ident: 10.0.0.5:0; Local LDP Ident 10.0.0.4:0
	TCP connection: 10.0.0.5.646 - 10.0.0.4.646
	State: Oper; Msgs sent/rcvd: 500/500; Downstream
	Up time: 02:30:00
	LDP discovery sources:
	  GigabitEthernet0/0.300, Src IP addr: 10.0.1.2
	        hello sent/rcvd: 1000/1000
	Addresses bound to peer LDP Ident:
	  10.0.1.2        10.0.2.2

Based on this output, what can be concluded?

Accepted Answer

The LDP session is operational with peer 10.0.0.5. The output shows 'State: Oper' and 'Up time: 02:30:00', which confirms the LDP session is fully operational. The peer LDP Ident is 10.0.0.5:0 and the local LDP Ident is 10.0.0.4:0, with a TCP connection established on port 646. This directly indicates that the LDP session with peer 10.0.0.5 is up and running.

Answer

LDP is not configured for VRF CUSTOMER-C

Answer

The LDP session is using TCP port 179

Answer

The peer is discovered via OSPF

Question 14

A network engineer runs the following command on Router R5:

R5# show ip interface brief | include VRF

Interface                  IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0.100     10.0.0.1        YES NVRAM  up                    up
GigabitEthernet0/0.200     10.0.1.1        YES NVRAM  up                    up
GigabitEthernet0/0.300     10.0.2.1        YES NVRAM  up                    up
Loopback100                10.100.0.1      YES NVRAM  up                    up

R5# show vrf brief

Name                             Default RD            Protocols   Interfaces
  CUSTOMER-A                       65000:1               ipv4        Gi0/0.100
  CUSTOMER-B                       65000:2               ipv4        Gi0/0.200
  CUSTOMER-C                       65000:3               ipv4        Gi0/0.300

Based on this output, what can be concluded?

Accepted Answer

VRF CUSTOMER-A uses RD 65000:1 and is associated with GigabitEthernet0/0.100. Option B is correct because the 'show vrf brief' output explicitly lists CUSTOMER-A with Route Distinguisher (RD) 65000:1 and its associated interface GigabitEthernet0/0.100. This confirms the VRF configuration and the interface-to-VRF mapping, which is fundamental for MPLS L3VPN path isolation.

Answer

All interfaces belong to the same VRF

Answer

Loopback100 is in VRF CUSTOMER-C

Answer

There is no VRF configured on Router R5

Question 15

A network engineer runs the following command on Router R6:

R6# show ip route vrf CUSTOMER-D

VRF CUSTOMER-D:
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/30 is directly connected, GigabitEthernet0/0.400
L        10.0.0.1/32 is directly connected, GigabitEthernet0/0.400
      192.168.0.0/16 is variably subnetted, 1 subnets, 1 mask
B        192.168.1.0/24 [200/0] via 10.0.0.2, 00:10:00

R6# show ip bgp vpnv4 vrf CUSTOMER-D

BGP table version is 5, local router ID is 10.0.0.6
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
              x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete

Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0/24   10.0.0.2                 0    100      0 i

Based on this output, what can be concluded?

Accepted Answer

The route 192.168.1.0/24 is installed in the VRF routing table from BGP. The show ip bgp vpnv4 vrf CUSTOMER-D output displays a BGP route for 192.168.1.0/24 with the '> ' (best) marker, and the show ip route vrf CUSTOMER-D output shows this route with a 'B' code (BGP). This confirms the route is learned via BGP and installed in the VRF routing table. The administrative distance of 200 in the routing table entry further confirms it is a BGP route (eBGP default AD is 20, but iBGP is 200; the [200/0] indicates iBGP).

Answer

The route 192.168.1.0/24 is learned via OSPF

Answer

The next-hop 10.0.0.2 is not reachable

Answer

VRF CUSTOMER-D has no directly connected networks