350-601 Network Practice Question
A data center uses Cisco ACI with multiple tenants. The security policy requires that all traffic between EPGs must be explicitly allowed via contracts. However, the operations team reports that communication between two EPGs in the same bridge domain is working even though no contract is applied. What is the most likely reason?
⚠ Common exam trap
Cisco often tests the misconception that contracts are required for all EPG-to-EPG communication, but the trap here is that intra-BD traffic is an exception where no contract is needed by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract
In Cisco ACI, the default behavior for EPGs within the same bridge domain (BD) is that they can communicate without a contract. This is because EPGs in the same BD share the same Layer 2 domain, and ACI does not enforce contract-based filtering for intra-BD traffic unless a contract is explicitly applied. The security policy requiring contracts applies only to inter-BD or inter-VRF traffic, not to intra-BD communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract
Why this is correct
ACI allows intra-BD communication by default; contracts are needed for inter-BD or inter-VRF traffic.
- ✗
The contract is applied but not enforced due to a configuration error
Why it's wrong here
If a contract is applied, it is enforced; absence of contract does not cause enforcement issue.
- ✗
The VRF has a default route that bypasses contract enforcement
Why it's wrong here
Default route does not bypass contract enforcement; contracts are applied at the leaf level regardless of routing.
- ✗
A preferred group contract is applied to the VRF
Why it's wrong here
Preferred group allows all EPGs in the VRF to communicate without explicit contracts; this would permit cross-BD traffic as well.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.