CCNP Virtualization Practice Question
Exhibit
Refer to the exhibit. CEF table snippet: Prefix Next Hop Interface 10.1.1.0/24 192.168.1.2 Ethernet0/0 10.2.2.0/24 192.168.2.2 Ethernet0/1 CEF table after VRF configuration: VRF: TENANT_A Prefix Next Hop Interface 10.1.1.0/24 192.168.1.2 Ethernet0/0.100 10.2.2.0/24 192.168.2.2 Ethernet0/1.200
A network engineer configured VRF TENANT_A and moved the subinterfaces into the VRF. After the change, the CEF table shows the prefixes but the next-hop addresses are unreachable. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the concept that VRF creates a completely isolated routing table, and the trap here is that candidates assume CEF showing the prefix means the route is fully functional, overlooking that the next-hop must also be in the same VRF.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The next-hop IP addresses are in the global routing table, not in the VRF.
When subinterfaces are moved into a VRF, the CEF table for that VRF will contain the learned prefixes, but the next-hop addresses must also be reachable within the same VRF. If the next-hop IP addresses reside in the global routing table instead of the VRF, the VRF will have no route to those next hops, causing them to be marked as unreachable. This is a common misconfiguration where the next-hop adjacency is not established within the VRF context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
LISP is not configured to map the virtual network.
Why it's wrong here
LISP maps endpoint identifiers to routing locators for overlay networks; it plays no part in resolving next hops within a VRF. The unreachable next hops stem from the interface addresses no longer residing in the global table after the VRF move. LISP would be relevant when designing a locator/ID separation overlay.
- ✓
The next-hop IP addresses are in the global routing table, not in the VRF.
Why this is correct
VRF segregation creates an independent routing and CEF table, so next hops must reside within the same VRF. If the next-hop addresses belong to the global table, they are unresolvable inside VRF TENANT_A, leaving prefixes present but next hops unreachable.
- ✗
OSPF is not redistributing the routes into the VRF.
Why it's wrong here
Moving subinterfaces into a VRF removes them from the global routing table, so the next-hop addresses must be reachable via a route inside VRF TENANT_A. Redistribution only controls route advertisement between protocols, not next-hop reachability. Redistribution would be the fix when OSPF routes must be shared with another protocol or VRF.
- ✗
The physical interface is not configured as a trunk.
Why it's wrong here
VRF membership is applied to subinterfaces, so the trunk encapsulation and allowed VLAN list on the physical interface must carry those VLANs; without trunking, subinterface traffic never reaches the VRF. It is tempting because trunking is a common Layer 2 oversight, and it would be correct if VLANs were missing from the allowed list.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.