mediumMultiple Choice
CCNP Practice Question: Migrating its legacy firewall services to a…
A company is migrating its legacy firewall services to a virtualized environment using Cisco NFV. The network engineer deploys a virtual firewall (vFW) on an NFVIS-enabled UCS platform. After the deployment, traffic through the vFW is intermittent and performance monitoring shows high CPU usage on the host. Which action should the engineer take to improve performance?
⚠ Common exam trap
A common mix-up: candidates assume adding more vCPUs (Option B) will solve performance issues, but Cisco tests the understanding that I/O bottlenecks in NFV are typically resolved by hardware offload techniques like SR-IOV, not by increasing compute resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SR-IOV on the physical NICs and assign VFs to the vFW.
SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch and reducing CPU overhead for packet processing. In an NFVIS environment, high host CPU usage with intermittent traffic indicates that the vFW is consuming excessive CPU cycles due to software-based I/O. Assigning VFs to the vFW offloads packet handling to the NIC hardware, lowering host CPU utilization and stabilizing traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable SR-IOV on the physical NICs and assign VFs to the vFW.
Why this is correct
SR-IOV enables a virtual function (VF) to be assigned directly to the vFW, bypassing the hypervisor's virtual switch and its associated CPU overhead. This allows the VM to perform I/O operations with near-native performance because the NIC hardware handles data plane processing, reducing latency and CPU usage. That is why it specifically addresses the bottleneck described in the scenario.
- ✗
Increase the number of vCPUs allocated to the vFW VM.
Why it's wrong here
Increasing vCPUs does not reduce the overhead incurred during packet traversal through the hypervisor's software virtual switch; the bottleneck is the hypervisor's I/O path, not a lack of CPU capacity. In fact, adding vCPUs can increase context-switching and cache pressure, and the vFW may not be able to utilize them efficiently due to licensing or packet-processing design. The issue is one of efficient packet delivery, not raw CPU throughput.
- ✗
Configure QoS policies on the vFW to prioritize traffic.
Why it's wrong here
QoS policies on the vFW influence traffic prioritization and bandwidth guarantees, but they have no effect on how packets are transferred between the physical NIC and the VM. The performance bottleneck is the hypervisor software switch's CPU cost per packet, which remains regardless of other QoS markers. QoS would only alter the scheduling of traffic, not reduce the CPU overhead of I/O processing.
- ✗
Disable hyperthreading on the host CPU.
Why it's wrong here
Disabling hyperthreading reduces the number of logical CPUs available to the host and the vFW, thereby decreasing the CPU resources that the hypervisor switch and the vFW could otherwise utilize. This would likely worsen the packet processing bottleneck rather than improve it. The correct approach is to remove the hypervisor's I/O bottleneck by using SR-IOV, not to reduce logical CPU capacity.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.