CCNA Virtualization Questions

Multi-Selecteasy

Which TWO of the following are benefits of using network virtualization with VXLAN? (Choose two.)

Select 2 answers

A.Enables Layer 2 extension across Layer 3 boundaries.

B.Eliminates the need for STP by using a centralized controller.

C.Uses only multicast for control plane learning.

D.Supports up to 16 million logical networks.

E.Provides native encryption for data in transit.

AnswersA, D

VXLAN tunnels Layer 2 over Layer 3.

Why this answer

VXLAN encapsulates Layer 2 frames in UDP packets over IP, allowing Layer 2 segments to be stretched across Layer 3 networks. This enables virtual machine mobility and multi-tenant environments without being constrained by physical network boundaries.

Exam trap

Cisco often tests the misconception that VXLAN eliminates STP or provides native encryption, but VXLAN is an overlay technology that still relies on the underlay network's STP and does not include encryption by default.

Practice this question →

Multi-Selecteasy

Which THREE of the following are components of a Cisco ACI fabric? (Choose three.)

Select 3 answers

A.Firewall

B.Spine switch

C.Router

D.APIC controller

E.Leaf switch

AnswersB, D, E

Spine switches form the fabric backbone.

Why this answer

The spine switch is a core component of a Cisco ACI fabric, forming the spine-leaf topology. Spine switches provide high-speed, non-blocking connectivity between leaf switches and handle all east-west traffic, relying on IS-IS as the routing protocol for fabric discovery and forwarding.

Exam trap

Cisco often tests the distinction between native fabric components (spine, leaf, APIC) and external devices (firewall, router) that can be integrated but are not part of the fabric itself, leading candidates to mistakenly include them as fabric components.

Practice this question →

MCQhard

A network engineer configured VRF TENANT_A and moved the subinterfaces into the VRF. After the change, the CEF table shows the prefixes but the next-hop addresses are unreachable. What is the most likely cause?

A.LISP is not configured to map the virtual network.

B.The next-hop IP addresses are in the global routing table, not in the VRF.

C.OSPF is not redistributing the routes into the VRF.

D.The physical interface is not configured as a trunk.

AnswerB

Next-hops must be in the same VRF to be reachable.

Why this answer

When subinterfaces are moved into a VRF, the CEF table for that VRF will contain the learned prefixes, but the next-hop addresses must also be reachable within the same VRF. If the next-hop IP addresses reside in the global routing table instead of the VRF, the VRF will have no route to those next hops, causing them to be marked as unreachable. This is a common misconfiguration where the next-hop adjacency is not established within the VRF context.

Exam trap

Cisco often tests the concept that VRF creates a completely isolated routing table, and the trap here is that candidates assume CEF showing the prefix means the route is fully functional, overlooking that the next-hop must also be in the same VRF.

How to eliminate wrong answers

Option A is wrong because LISP (Locator/ID Separation Protocol) is not required for basic VRF operation; it is used for overlay network virtualization and mobility, not for resolving next-hop reachability within a VRF. Option C is wrong because OSPF redistribution is not the root cause; the issue is that the next-hop addresses are not present in the VRF's routing table, not that routes are missing from OSPF. Option D is wrong because trunk configuration on the physical interface is irrelevant to VRF next-hop reachability; subinterfaces can be placed into a VRF regardless of whether the parent interface is a trunk or access port.

Practice this question →

Multi-Selecteasy

Which TWO statements correctly describe characteristics of virtual device contexts (VDCs) in Cisco Nexus switches?

Select 2 answers

A.VDCs allow overlapping VLAN IDs across different VDCs only if using different VNIs.

B.VDCs provide Layer 3 routing isolation by default across all VDCs.

C.Each VDC can have its own admin account and separate management interface.

D.VDCs are supported on all Cisco IOS-XE switches.

E.VDCs enable partitioning of a single physical switch into multiple logical switches.

AnswersC, E

Correct: VDCs provide administrative and management isolation.

Why this answer

Each VDC in a Cisco Nexus switch can be configured with its own administrative credentials and a dedicated management interface (e.g., mgmt0). This allows separate administrative domains and management access per VDC, which is a key feature for multi-tenant environments.

Exam trap

Cisco often tests the misconception that VDCs automatically provide Layer 3 routing isolation, but in reality, routing isolation requires explicit VRF configuration per VDC.

Practice this question →

Matchingmedium

Match each network device to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Forwards packets between different networks

Forwards frames within the same network

Controls traffic based on security policies

Manages access points centrally

Distributes traffic across multiple servers

Why these pairings

Correct matches: Router forwards packets between networks, Switch forwards frames within a network, Firewall filters traffic. Common confusions include swapping these roles.

Practice this question →

Matchingmedium

Match each Cisco switch security feature to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Limits MAC addresses on a port

Filters untrusted DHCP messages

Validates ARP packets

Prevents IP spoofing

Limits broadcast/multicast traffic

Why these pairings

Port Security limits MAC addresses per port to prevent MAC flooding. DHCP Snooping filters DHCP messages to block rogue servers. Dynamic ARP Inspection validates ARP packets using DHCP snooping entries to prevent spoofing.

IP Source Guard filters IP traffic based on the binding table to prevent IP spoofing. Common confusions include swapping these functions, e.g., assigning ARP spoofing prevention to Port Security or MAC flooding prevention to DHCP Snooping.

Practice this question →

Multi-Selecthard

A data center uses Cisco Nexus 9000 switches with VXLAN EVPN to provide network virtualization. The operations team notices that VLAN 100 (mapped to VNI 10100) is not reachable across the fabric, although other VLANs work fine. The NVE interface is up, and the EVPN address-family is configured. Which two actions should the engineer take to isolate the issue?

Select 2 answers

A.Check if EVPN type-3 routes are being advertised for VNI 10100.

B.Confirm that multicast group 239.1.1.1 is reachable across the underlay.

C.Verify that VLAN 100 is mapped to VNI 10100 consistently on all VTEPs.

D.Ensure that VNI 10100 is added under the NVE interface.

E.Check if the MTU on the underlay is set to at least 1550 bytes.

AnswersC, D

Inconsistent mapping breaks VXLAN bridging.

Why this answer

VXLAN EVPN requires consistent VLAN-to-VNI mapping across all VTEPs in the fabric. If VLAN 100 is mapped to VNI 10100 on some switches but not others, traffic for that VNI will not be forwarded correctly, as the mapping is used to associate local VLANs with the VXLAN segment. Option D is correct because the VNI must be explicitly enabled under the NVE interface to participate in VXLAN tunnel termination; without it, the VTEP will not encapsulate or decapsulate traffic for VNI 10100.

Exam trap

Cisco often tests the distinction between control-plane (BGP EVPN) and data-plane (multicast) VXLAN, leading candidates to incorrectly check multicast reachability (Option B) when the issue is a missing or inconsistent VNI configuration.

Practice this question →

Multi-Selecteasy

Which TWO statements about virtual switching in a hypervisor environment are correct?

Select 2 answers

A.A virtual switch can be connected to a physical network through uplink ports.

B.A virtual switch does not support VLAN tagging.

C.A virtual switch performs routing between different subnets.

D.A virtual switch forwards frames between virtual machines based on MAC addresses.

E.A virtual switch is a physical device installed in the hypervisor host.

AnswersA, D

Correct. Uplink ports map to physical NICs to provide connectivity to the physical network.

Why this answer

A virtual switch connects to the physical network through uplink ports, which are typically mapped to physical NICs on the hypervisor host. This allows VMs on the virtual switch to communicate with external networks, making option A correct.

Exam trap

Cisco often tests the misconception that virtual switches are physical devices or that they perform Layer 3 functions, when in fact they are software-based Layer 2 forwarding engines that support VLANs and uplink connectivity.

Practice this question →