350-601 Security Practice Question
A large enterprise data center uses Cisco ACI with a spine-leaf architecture. The security team requires that all traffic between the Web and App tiers be inspected by a firewall, but traffic within the same tier should be allowed directly. The Web EPG is in VRF PROD with Bridge Domain WEB-BD, and App EPG is in VRF PROD with Bridge Domain APP-BD. The firewall is connected as a service graph device in a different VRF (FW-VRF). The administrator configures a contract between Web and App EPGs that redirects traffic through the firewall. However, after implementation, traffic from Web to App is not passing through the firewall; instead, it is forwarded directly. The contract is applied correctly. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the misconception that a service graph device can be in any VRF as long as the contract is applied correctly, but in reality, the VRF alignment is mandatory for the redirect to function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall is in a different VRF; service graphs require the firewall to be in the same VRF as the endpoints or use a shared VRF with appropriate route leaking.
In Cisco ACI, service graphs redirect traffic through firewall devices by inserting the firewall as a Layer 4-Layer 7 device in the traffic path. However, the service graph device must reside in the same VRF as the consumer and provider EPGs, or a shared VRF with proper route leaking must be configured, because ACI uses VRF isolation to enforce policy-based redirect (PBR). Since the firewall is in FW-VRF while both EPGs are in VRF PROD, the leaf switches cannot redirect traffic to the firewall without a common routing context, causing the contract to bypass the firewall and forward traffic directly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The firewall is in a different VRF; service graphs require the firewall to be in the same VRF as the endpoints or use a shared VRF with appropriate route leaking.
Why this is correct
ACI service graph redirection typically works within the same VRF or with PBR; different VRFs break the redirection.
- ✗
The firewall is not reachable from the leaf switches due to a routing issue.
Why it's wrong here
Reachability is not the primary issue; the redirection mechanism itself is flawed due to VRF mismatch.
- ✗
The contract filter is misconfigured, allowing direct communication without redirection.
Why it's wrong here
The contract filter specifies the protocol, but redirection is a separate service graph configuration.
- ✗
The contract is applied only to intra-EPG traffic, not inter-EPG traffic.
Why it's wrong here
Contracts define inter-EPG traffic, not intra-EPG.
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.