CCNP Infrastructure Practice Question
A network engineer is implementing VXLAN with a Cisco Nexus 9000 series switch acting as a VTEP. The engineer needs to ensure that the VXLAN overlay can carry traffic for multiple tenants while maintaining isolation. Which component is responsible for identifying the VXLAN segment and providing tenant isolation?
⚠ Common exam trap
The trap here is assuming that the outer VLAN ID or IP addresses provide tenant isolation, when in fact the VNI is the sole identifier for the VXLAN segment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VXLAN Network Identifier (VNI)
The VXLAN Network Identifier (VNI) is a 24-bit field in the VXLAN header that uniquely identifies each VXLAN segment. It allows up to 16 million segments, enabling massive multi-tenancy. Tenant isolation is achieved because each VNI represents a separate logical network, and traffic from different VNIs is not mixed. The VNI is the key component for identifying the segment and ensuring isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Destination IP address in the outer IP header
Why it's wrong here
The destination IP address in the outer IP header identifies the remote VTEP, not the tenant. While it is used for routing the encapsulated packet, it does not provide tenant isolation. Multiple tenants can share the same destination VTEP IP address, so isolation must come from the VNI.
- ✓
VXLAN Network Identifier (VNI)
Why this is correct
The VNI is a 24-bit identifier that uniquely identifies a VXLAN segment. It provides isolation for tenants by separating traffic into distinct logical networks. Each VNI maps to a specific Layer 2 or Layer 3 domain, ensuring that traffic from different tenants remains isolated even when using the same underlay.
- ✗
UDP source port number
Why it's wrong here
The UDP source port number is used for load balancing and does not identify the VXLAN segment or provide tenant isolation. It is dynamically generated by the VTEP and is not a tenant identifier. Tenant isolation relies on the VNI, not on transport-layer port numbers.
- ✗
VLAN ID in the outer Ethernet header
Why it's wrong here
The outer Ethernet header VLAN ID is used for the underlay transport and does not provide tenant isolation in VXLAN. Tenant isolation is based on the VXLAN Network Identifier (VNI). Using an outer VLAN ID would only segment the physical network, not the overlay.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.