CCNP Virtualization Practice Question
A network engineer is troubleshooting a Cisco IOS-XE router that hosts several virtual routing and forwarding instances. A route to 10.20.30.0/24 exists in both the global routing table and in VRF CUSTOMER_A. A packet arrives on an interface assigned to VRF CUSTOMER_A with destination 10.20.30.10. How does the router determine which routing table to consult?
⚠ Common exam trap
The trap here is believing the router compares or falls back between the global table and a VRF table when both contain the same prefix.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It uses the VRF forwarding table associated with the ingress interface's VRF.
The VRF used for a forwarding lookup is determined by the VRF membership of the ingress interface, not by the destination address. Once the interface's VRF is identified, the router performs a longest prefix match inside that VRF's forwarding table, which keeps overlapping tenant and global addressing independent and isolated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It always consults the global routing table first and falls back to the VRF table only if no match is found.
Why it's wrong here
There is no fallback from the global table into a VRF table. The ingress interface's VRF determines the lookup from the start, so a matching global prefix is irrelevant and cannot be selected for a packet arriving on an interface bound to VRF CUSTOMER_A.
- ✗
It uses the destination address to choose the VRF whose route has the longest prefix match.
Why it's wrong here
Longest prefix match is applied inside a single table once that table is selected. The destination address does not pick which VRF to use; the ingress interface binding does. Treating the destination as the VRF selector would break tenant isolation entirely.
- ✓
It uses the VRF forwarding table associated with the ingress interface's VRF.
Why this is correct
VRF selection is driven by the ingress interface. Because the receiving interface is bound to VRF CUSTOMER_A, the router performs the lookup in the CUSTOMER_A forwarding table, where the 10.20.30.0/24 route may point to a different next hop than the global entry, keeping tenant traffic isolated.
- ✗
It compares administrative distance between the global and VRF entries and selects the lower value.
Why it's wrong here
Administrative distance compares routes within the same routing table. The global table and a VRF table are separate forwarding instances, so their entries are never ranked against each other, and no distance comparison decides which table serves the packet.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.