CCNP Virtualization Practice Question
A network architect is designing a Cisco ACI fabric for a multi-tenant data center. Tenants must be isolated at Layer 3, but some tenants require shared services such as a firewall and load balancer. Which Cisco ACI construct should the architect use to allow selective communication between tenants while maintaining isolation?
⚠ Common exam trap
The trap here is thinking that shared services require merging VRFs or bridge domains, when ACI actually provides cross-tenant contracts with the common tenant to maintain isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A contract between the tenant EPG and a shared services EPG in the common tenant
Cisco ACI enables selective inter-tenant communication by placing shared services in the common tenant and using contracts that are exported and consumed by tenant EPGs. This preserves Layer 3 isolation between tenants while permitting only the traffic defined by the contract. The shared services EPG can be a firewall or load balancer, and the contract enforces the allowed protocols and ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A VRF leak between the tenant VRFs using route targets
Why it's wrong here
VRF leaking would merge the routing tables of the tenants, breaking the required Layer 3 isolation. While route targets are used for L3Out and shared services in some designs, a full leak is not selective and would allow broader reachability than intended. The architect needs a policy-based mechanism, not a routing table merge.
- ✗
A bridge domain shared between tenants with a common subnet
Why it's wrong here
Sharing a bridge domain and subnet would place tenant endpoints in the same Layer 2 domain, eliminating isolation and creating overlapping address concerns. The requirement is Layer 3 isolation with selective shared services, which is achieved through contracts and shared EPGs, not by merging broadcast domains across tenants.
- ✗
A shared L3Out with a common EPG for all tenants
Why it's wrong here
A shared L3Out can provide external connectivity, but placing all tenants in a common EPG removes the Layer 3 isolation the design requires. It would allow unrestricted communication between tenants, violating the isolation requirement. Shared services in ACI are typically implemented with contracts between EPGs, not by merging tenants into one EPG.
- ✓
A contract between the tenant EPG and a shared services EPG in the common tenant
Why this is correct
In Cisco ACI, the common tenant can host shared services EPGs, and contracts can be exported and consumed across tenants. This allows a tenant EPG to communicate with the shared firewall or load balancer while keeping other inter-tenant traffic isolated. The contract defines exactly which protocols and ports are permitted, satisfying both sharing and isolation.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.