CCNP Virtualization Practice Question
A network engineer is deploying a VXLAN EVPN fabric on Cisco Nexus 9000 switches. The engineer must configure the NVE interface and ensure proper VXLAN data plane operation. Which two statements about VXLAN EVPN configuration on Nexus 9000 are true? (Choose two.)
⚠ Common exam trap
The trap here is assuming that multicast is always required for BUM traffic in VXLAN, when in EVPN deployments ingress replication can be used instead, making multicast optional.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EVPN control plane requires BGP to be configured with the EVPN address family on the spine and leaf switches.
The NVE interface requires a reachable source interface for VXLAN tunnels to form, and the EVPN control plane relies on BGP with the EVPN address family to exchange MAC and IP reachability information. These two statements are true for VXLAN EVPN configuration on Nexus 9000. The other options are either general VXLAN facts not specific to EVPN configuration, incorrect requirements, or applicable only to flood-and-learn VXLAN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The EVPN control plane requires BGP to be configured with the EVPN address family on the spine and leaf switches.
Why this is correct
In a VXLAN EVPN fabric, BGP is used as the EVPN control plane. The spine and leaf switches must be configured with the EVPN address family (address-family l2vpn evpn) to exchange EVPN routes. This allows the fabric to learn MAC addresses and IP addresses dynamically, reducing the need for flooding. Without BGP EVPN, the fabric would rely on data plane learning, which is less efficient. Thus, this statement is true for Nexus 9000 VXLAN EVPN configuration.
- ✗
VXLAN uses a 24-bit VNI field, allowing for up to 16 million unique VNIs.
Why it's wrong here
VXLAN uses a 24-bit VNI field, which allows for up to 16 million unique VNIs. However, this is a general VXLAN fact, not specific to Cisco Nexus 9000 configuration. The question asks about VXLAN EVPN configuration on Nexus 9000, and while this statement is technically true, it is not a configuration requirement or a statement about the configuration itself. The focus should be on the configuration steps and requirements for the NVE interface and EVPN control plane.
- ✓
The NVE interface must be configured with a source interface that is reachable via the underlay routing protocol.
Why this is correct
The NVE interface requires a source interface (typically a loopback) to be specified. This source interface must be reachable through the underlay network so that VTEPs can establish VXLAN tunnels. The underlay routing protocol (e.g., OSPF or BGP) advertises the loopback address, ensuring that remote VTEPs can reach it. Without a reachable source interface, VXLAN tunnels cannot be formed, and traffic cannot be encapsulated or decapsulated correctly.
- ✗
Each VNI must be mapped to a unique VLAN on every leaf switch in the fabric.
Why it's wrong here
VNI-to-VLAN mapping is local to each leaf switch and does not have to be unique across the fabric. The same VLAN ID can be used for different VNIs on different leaf switches, or the same VNI can be mapped to different VLANs on different leaf switches. The VNI is the global identifier, while the VLAN is local. Therefore, the statement that each VNI must be mapped to a unique VLAN on every leaf is false; it is not a requirement.
- ✗
The NVE interface must be configured with a multicast group for broadcast, unknown unicast, and multicast (BUM) traffic.
Why it's wrong here
In a VXLAN EVPN fabric with ingress replication, multicast is not required. The EVPN control plane can use ingress replication to handle BUM traffic, where each VTEP sends BUM traffic to all other VTEPs via unicast. Multicast group configuration is used in flood-and-learn VXLAN deployments without EVPN. Since the scenario specifies VXLAN EVPN, multicast is not mandatory. Thus, this statement is false for EVPN-based fabrics.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.