mediumMultiple Select
CCNP Practice Question: Which three statements about path isolation using…
Which three statements about path isolation using VRF are true? (Choose three.)
⚠ Common exam trap
Many candidates confuse VRF with encryption or assuming VRF-lite requires a full mesh; candidates often mistakenly think VRFs provide security through encryption, but they only provide logical separation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VRFs allow overlapping IP addresses between different virtual networks on the same router.
Option A is correct because a VRF maintains a separate routing and forwarding table (RIB/FIB) per virtual network, so the same IP prefix, such as 10.0.0.0/24, can exist in multiple VRFs on the same router without conflict. Option B is correct because VRF-lite implements path isolation using only VRFs and per-VRF interface/static or routing-protocol instances, without requiring MPLS labels or an MPLS-enabled core. Option D is correct because service providers commonly use VRFs (for example, in MPLS L3VPN or VRF-lite designs) to keep each customer's traffic in a distinct routing and forwarding instance, preventing route leakage between customers. Option C is not correct because VRFs provide logical separation of routing and forwarding, not cryptographic protection; encryption would require IPsec or another security mechanism. Option E is not correct because VRF-lite does not mandate a full mesh of trunk links; it relies on per-VRF subinterfaces or links and appropriate routing, and full-mesh topologies are not a VRF-lite requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VRFs allow overlapping IP addresses between different virtual networks on the same router.
Why this is correct
Each VRF maintains its own separate routing and forwarding table, so identical IP prefixes can exist in different VRFs on the same router without conflict. This satisfies the stem's requirement for overlapping IP addresses between virtual networks.
- ✓
VRF-lite can provide path isolation without the use of MPLS.
Why this is correct
VRF-lite maintains separate routing and forwarding tables per interface on a single device, achieving path isolation without MPLS labels or LDP. This satisfies the stem's requirement for isolation absent a service-provider MPLS core, since overlapping address spaces remain segregated by distinct VRF instances rather than label-switched paths.
- ✗
VRF-based path isolation ensures encryption of all data between VRFs.
Why it's wrong here
VRF provides logical traffic separation through separate routing and forwarding tables; it performs no encryption, which requires IPsec or MACsec. It is tempting because isolated paths feel secure, but confidentiality is simply outside VRF's forwarding-plane function.
- ✓
A VRF can be used to separate customer traffic in a service provider network.
Why this is correct
A VRF creates an isolated routing and forwarding instance, so a service provider can assign each customer its own VRF on provider edge routers. This satisfies the stem's requirement to separate customer traffic in a service provider network.
- ✗
VRF-lite requires a full mesh of trunk links between all routers in the network.
Why it's wrong here
VRF-lite needs no trunk mesh; it relies on 802.1Q subinterfaces, with each VRF mapped to a VLAN on the connecting link. It is tempting because full-mesh topologies are common in MPLS VPN designs, but VRF-lite deliberately avoids that requirement.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.