350-601 Security Practice Question
An organization is deploying Cisco ACI in a brownfield data center. They have existing VLANs that need to be mapped to ACI EPGs. The network team notices that some VLANs are used across multiple tenants. How should the engineer design the VLAN pool to support overlapping VLANs?
⚠ Common exam trap
Cisco often tests the misconception that a single VLAN pool can be shared across tenants with overlapping VLANs, but in reality, VLAN pools are domain-scoped and overlapping IDs require separate pools to maintain isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate VLAN pools per tenant, each containing the required VLANs.
In Cisco ACI, VLAN pools are scoped to a physical domain, and overlapping VLANs across tenants require separate VLAN pools per tenant. Each tenant's EPG is statically bound to its own VLAN pool, ensuring isolation and preventing VLAN conflicts. This design aligns with ACI's multi-tenant architecture where VLAN IDs must be unique within a domain but can be reused across different domains.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the VLANs as part of the EPG static binding without a pool.
Why it's wrong here
Static binding still requires a VLAN pool.
- ✓
Create separate VLAN pools per tenant, each containing the required VLANs.
Why this is correct
Each tenant gets its own VLAN pool, allowing reuse.
- ✗
Create one VLAN pool per physical domain and assign tenants to that domain.
Why it's wrong here
Domains are for connectivity, not VLAN isolation.
- ✗
Create a global VLAN pool with all VLANs and assign it to all tenants.
Why it's wrong here
Overlapping VLANs would conflict.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 984 original 350-601 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.