hardMultiple Choice
CCNP Practice Question: A service provider wants to deploy a virtualized…
A service provider wants to deploy a virtualized firewall as a VNF in a service chain. The VNF must be inserted transparently into the traffic path without requiring changes to the existing IP addressing. Which service chaining method should the architect choose?
⚠ Common exam trap
Cisco often tests the misconception that inline mode with proxy ARP is the simplest transparent insertion method, but candidates overlook that proxy ARP modifies Layer 2 behavior and can break transparency, whereas PBR operates at Layer 3 without altering IP addressing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement policy-based routing (PBR) to redirect traffic to the VNF.
Policy-based routing (PBR) allows the architect to redirect traffic to the VNF based on match criteria such as source/destination IP or protocol, without altering the existing IP addressing scheme. This enables transparent insertion of the VNF into the service chain, as PBR overrides the routing table for selected traffic and forwards it to the virtualized firewall, while the original IP headers remain unchanged.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use static routing to point traffic to the VNF.
Why it's wrong here
Static routing requires the VNF to become the next hop for the entire subnet, forcing endpoints to change their default gateway and altering IP addressing. It also redirects all traffic without policy granularity, and because the VNF's IP is not transparent, return traffic can be asymmetrical or require additional static routes on the upstream and downstream devices.
- ✓
Implement policy-based routing (PBR) to redirect traffic to the VNF.
Why this is correct
PBR matches traffic based on source, destination, or protocol and overrides the routing table by setting a next-hop to the VNF, all without changing endpoint IP configuration. This enables selective, policy-based service chaining while keeping the original source and destination addresses intact, so the VNF can process traffic and forward it back to the intended path.
- ✗
Deploy the VNF in inline mode with proxy ARP.
Why it's wrong here
Deploying the VNF inline with proxy ARP is not a service-chaining mechanism because proxy ARP only responds to ARP requests on behalf of remote hosts, enabling basic Layer 2 reachability. It does not steer traffic through a VNF based on policy, and in a high-availability or complex topology it can cause ARP cache poisoning and transparency problems that break application session continuity.
- ✗
Use VRF-lite to separate traffic and route through the VNF.
Why it's wrong here
VRF-lite separates traffic into distinct routing tables, but inserting a VNF still requires route leaking or import/export between VRFs, which often forces IP address changes or introduces complex redistribution. It does not provide transparent interception; instead, traffic must be explicitly routed via interfaces attached to the VNF, so it is not a self-contained method for transparent service insertion.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.