CCNA Network Questions — Page 1 of 3

Matchingmedium

Match each Cisco data center technology to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Converged network for Fibre Channel and Ethernet

Network virtualization overlay for scaling Layer 2 networks

Layer 2 extension across Layer 3 boundaries

Location/identifier separation for routing scalability

Label switching for traffic engineering and VPNs

Why these pairings

VDC partitions switches; VPC provides redundant LAG; FEX extends fabric ports; OTV extends Layer 2 over Layer 3.

Practice this question →

MCQeasy

Refer to the exhibit. A network engineer notices that the NVE1 interface is up but VXLAN traffic is not being encapsulated. What is the most likely cause?

A.The VNI 10000 is not mapped to a VLAN.

B.The ingress replication protocol must be static.

C.The loopback0 interface is not configured.

D.The BGP EVPN address-family is not activated.

AnswerD

EVPN requires MP-BGP with the l2vpn evpn address-family to exchange routes; without it, VXLAN encapsulation cannot function.

Why this answer

VXLAN traffic encapsulation on the NVE1 interface requires the BGP EVPN address-family to be activated under the BGP configuration to exchange VNI-to-VTEP mappings. Without this address-family, the NVE interface cannot learn remote VTEPs, so VXLAN packets are never encapsulated with the outer UDP/IP header.

Exam trap

Cisco often tests the misconception that an NVE interface being up means VXLAN encapsulation is fully functional, but the control plane (BGP EVPN) must be active to provide the necessary remote VTEP information.

How to eliminate wrong answers

Option A is wrong because VNI 10000 not being mapped to a VLAN would prevent local bridging, but the NVE interface can still encapsulate VXLAN traffic if the VNI is configured under the NVE and the BGP EVPN control plane is operational. Option B is wrong because ingress replication can be configured as static or dynamic (via BGP EVPN); the protocol does not need to be static—dynamic replication via BGP EVPN is standard. Option C is wrong because the loopback0 interface is likely already configured (the exhibit shows it as the source interface under NVE1), and if it were missing, the NVE interface would not come up at all.

Practice this question →

MCQhard

A network engineer notices that when a host sends a packet to a destination on a different VTEP, the packet is flooded to all VTEPs even though the destination MAC is known. What is the most likely cause?

A.The BGP EVPN route table is missing the MAC/IP route for the destination.

B.The VNI is misconfigured.

C.The MTU exceeds 1500 bytes.

D.ARP suppression is disabled.

AnswerA

Without the route, the VTEP has no forwarding information and floods.

Why this answer

In a BGP EVPN VXLAN fabric, when a host sends a packet to a known destination MAC on a different VTEP, the ingress VTEP should perform MAC/IP route lookup in the BGP EVPN route table to determine the correct remote VTEP. If the MAC/IP route for the destination is missing (e.g., not advertised or withdrawn), the ingress VTEP has no mapping to a remote VTEP and must flood the packet to all VTEPs in the VNI, causing unnecessary broadcast traffic. This is the most likely cause of the described behavior.

Exam trap

The trap here is that candidates often confuse flooding due to an unknown MAC (which is normal) with flooding due to a missing EVPN route, or they incorrectly attribute the issue to ARP suppression or MTU problems, which are unrelated to the data-plane flooding of a known MAC across VTEPs.

How to eliminate wrong answers

Option B is wrong because a misconfigured VNI would typically prevent the packet from being encapsulated or forwarded at all, or cause it to be dropped, not flooded to all VTEPs. Option C is wrong because an MTU exceeding 1500 bytes would cause fragmentation or drop issues, not flooding behavior. Option D is wrong because ARP suppression is a control-plane optimization that reduces ARP broadcast traffic within a VNI; disabling it would cause ARP requests to be flooded, but the question describes flooding of a data packet with a known destination MAC, which is unrelated to ARP suppression.

Practice this question →

MCQeasy

A network engineer is configuring OSPF on a pair of Nexus 9000 switches acting as spine switches in a VXLAN fabric. The engineer needs to ensure that the spine switches do not become the DR for any VLAN. Which configuration should be applied?

A.Configure passive-interface default under OSPF.

B.Set ospf network type to point-to-multipoint.

C.Set ospf priority to 0 on the spine interfaces.

D.Set ospf priority to 255 on the spine interfaces.

AnswerC

OSPF priority 0 prevents the router from participating in DR/BDR election.

Why this answer

Setting the OSPF priority to 0 on the spine interfaces prevents the spine switches from participating in the DR/BDR election process, ensuring they never become the Designated Router (DR) for any VLAN. This is the standard method to suppress DR election on a multi-access network segment.

Exam trap

Cisco often tests the misconception that setting OSPF priority to 0 disables OSPF on the interface entirely, when in fact it only prevents DR/BDR election while still allowing neighbor adjacency formation.

How to eliminate wrong answers

Option A is wrong because configuring passive-interface default under OSPF suppresses all OSPF hello packets on all interfaces, preventing neighbor adjacency formation entirely, which would break OSPF routing. Option B is wrong because setting the OSPF network type to point-to-multipoint does not inherently prevent a router from becoming DR; it changes the behavior to treat the network as a collection of point-to-point links but still allows DR election on multi-access segments. Option D is wrong because setting the OSPF priority to 255 (the highest possible value) makes the spine switch the most likely candidate to become the DR, which is the opposite of the desired outcome.

Practice this question →

MCQeasy

Which BGP variant is commonly used in spine-leaf fabrics to advertise EVPN routes for VXLAN?

A.MP-BGP with EVPN address family

B.OSPF with opaque LSA

C.eBGP with standard IPv4 unicast

D.iBGP with standard IPv4 unicast

AnswerA

MP-BGP with EVPN address family (AFI L2VPN, SAFI EVPN) is used for VXLAN control plane.

Why this answer

MP-BGP with the EVPN address family (AFI 25 / SAFI 70) is the control-plane protocol used in VXLAN spine-leaf fabrics to advertise MAC/VTEP reachability, host routes, and integrated routing and bridging (IRB) information. This allows the spine to act as a route reflector, distributing EVPN type-2 (MAC/IP) and type-3 (IMET) routes to all leaf nodes, enabling efficient, loop-free overlay forwarding.

Exam trap

Cisco often tests the distinction between the control-plane protocol (MP-BGP EVPN) and the data-plane encapsulation (VXLAN), so the trap here is that candidates confuse the underlay routing protocol (e.g., OSPF or eBGP IPv4 unicast) with the overlay control-plane protocol needed for EVPN route advertisement.

How to eliminate wrong answers

Option B is wrong because OSPF with opaque LSA is used for MPLS Traffic Engineering or GMPLS signaling, not for advertising EVPN routes in VXLAN fabrics. Option C is wrong because eBGP with standard IPv4 unicast only carries IPv4 prefix information and cannot carry the MAC, VNI, and VTEP information required for EVPN overlay routes. Option D is wrong because iBGP with standard IPv4 unicast similarly lacks the EVPN address family and cannot transport the necessary overlay control-plane information for VXLAN.

Practice this question →

MCQhard

In a VXLAN EVPN fabric with MP-BGP, which route type is used to advertise MAC addresses and associated VNI?

A.Type 3: Inclusive Multicast Ethernet Tag

B.Type 1: Ethernet Auto-Discovery

C.Type 5: IP Prefix

D.Type 2: MAC/IP Advertisement

AnswerD

Advertises MAC addresses and optionally IPs.

Why this answer

Type 2 (MAC/IP Advertisement) routes are used in VXLAN EVPN fabrics with MP-BGP to advertise MAC addresses, their associated VNI, and optionally IP addresses. This route type enables the control plane to distribute host reachability information, allowing VTEPs to build and update their forwarding tables dynamically.

Exam trap

Cisco often tests the distinction between control plane (Type 2) and data plane (Type 3) advertisement mechanisms, tempting candidates to confuse multicast group management with MAC address learning.

How to eliminate wrong answers

Option A is wrong because Type 3 (Inclusive Multicast Ethernet Tag) routes are used to advertise multicast group membership for BUM traffic, not individual MAC addresses. Option B is wrong because Type 1 (Ethernet Auto-Discovery) routes are used for redundancy and fast convergence (e.g., aliasing and backup paths), not for MAC/VNI advertisement. Option C is wrong because Type 5 (IP Prefix) routes are used to advertise IP prefixes (e.g., external networks) in EVPN, not MAC addresses.

Practice this question →

MCQmedium

An engineer needs to extend a Layer 2 VLAN across a VXLAN EVPN fabric. Which construct maps the VLAN to the overlay network?

A.VLAN ID

B.VTEP IP

C.VNI

D.VPC

AnswerC

Correct: VNI maps to the VLAN.

Why this answer

In a VXLAN EVPN fabric, the VNI (VXLAN Network Identifier) is the construct that maps a Layer 2 VLAN to the overlay network. The VNI uniquely identifies a Layer 2 segment across the underlay, allowing VLAN traffic to be encapsulated and transported over the IP fabric. This mapping is configured on the VTEP (VXLAN Tunnel Endpoint) using commands like 'vlan 100' mapped to 'vn-segment 10100' under the VLAN configuration.

Exam trap

Cisco often tests the distinction between VLAN ID (local significance) and VNI (global overlay identifier), and the trap here is that candidates confuse the VTEP IP (the tunnel endpoint) with the VNI (the network identifier), or think VPC plays a role in overlay mapping.

How to eliminate wrong answers

Option A is wrong because the VLAN ID is a Layer 2 identifier local to a switch or within a broadcast domain, and it does not provide the global segmentation needed for VXLAN overlay networks; the VNI is used instead. Option B is wrong because the VTEP IP is the source or destination IP address used for VXLAN encapsulation and decapsulation, not the identifier that maps a VLAN to the overlay. Option D is wrong because VPC (Virtual Port Channel) is a Cisco technology for link aggregation and redundancy, unrelated to VLAN-to-VXLAN mapping.

Practice this question →

MCQeasy

Which STP variant provides per-VLAN load balancing and is commonly used in data center networks with Cisco Nexus switches?

A.Rapid PVST+

B.MST

C.RSTP

D.STP

AnswerA

Rapid PVST+ runs a separate RSTP instance per VLAN.

Why this answer

Rapid PVST+ (Per-VLAN Spanning Tree Plus) is the correct answer because it provides per-VLAN load balancing by running a separate instance of RSTP (802.1w) for each VLAN. This allows different VLANs to use different root bridges and forwarding paths, enabling traffic load sharing across redundant links. Cisco Nexus switches support Rapid PVST+ as a default or commonly configured STP variant in data center environments, offering fast convergence and VLAN-based traffic engineering.

Exam trap

Cisco often tests the distinction between per-VLAN (Rapid PVST+) and per-instance (MST) load balancing, where candidates mistakenly choose MST because it reduces STP instances, but the question explicitly asks for per-VLAN load balancing, which only Rapid PVST+ provides.

How to eliminate wrong answers

Option B (MST) is wrong because MST (Multiple Spanning Tree Protocol, 802.1s) maps multiple VLANs into a single spanning tree instance, reducing the number of STP instances but not providing per-VLAN load balancing; it groups VLANs, which can lead to suboptimal path usage for individual VLANs. Option C (RSTP) is wrong because RSTP (Rapid Spanning Tree Protocol, 802.1w) is a single-instance protocol that does not support per-VLAN load balancing; it operates on the entire bridged network without VLAN awareness. Option D (STP) is wrong because classic STP (802.1D) is a single-instance protocol with slow convergence (30-50 seconds) and no VLAN awareness, making it unsuitable for per-VLAN load balancing in modern data center networks.

Practice this question →

Multi-Selecteasy

A data center network uses Cisco Nexus switches with VXLAN EVPN. Which two components are essential for VXLAN EVPN operation? (Choose two.)

Select 2 answers

A.VXLAN VTEPs on leaf switches.

B.OSPF as underlay routing protocol.

C.MP-BGP EVPN control plane.

D.VPC for host-facing links.

E.PIM-SM for multicast replication.

AnswersA, C

VTEPs encapsulate and decapsulate VXLAN frames.

Why this answer

VXLAN VTEPs (VXLAN Tunnel Endpoints) on leaf switches are essential because they perform the encapsulation and decapsulation of VXLAN frames, enabling Layer 2 overlay networks over a Layer 3 underlay. Without VTEPs, there is no mechanism to create the VXLAN tunnels that carry traffic between endpoints across the IP fabric.

Exam trap

Cisco often tests the distinction between mandatory components (VTEPs and MP-BGP EVPN) and optional features (vPC, specific underlay protocols, or replication modes) to see if candidates understand that the underlay can be any IP-routed network and that multicast is not a requirement for VXLAN EVPN.

Practice this question →

MCQeasy

Which VLAN trunking protocol is used by default on Cisco Nexus switches to carry multiple VLANs over a single link?

A.VTP

B.DTP

C.ISL

D.802.1Q

AnswerD

802.1Q is the standard trunking protocol used on Nexus switches.

Why this answer

802.1Q is the IEEE standard trunking protocol used by default on Cisco Nexus switches to carry multiple VLANs over a single link. Unlike older Cisco switches that defaulted to ISL, Nexus switches exclusively support 802.1Q encapsulation for VLAN trunking, as ISL is not supported on the NX-OS platform.

Exam trap

Cisco often tests the misconception that DTP or VTP is a trunking protocol, but the trap here is that candidates confuse negotiation or management protocols with the actual encapsulation method used to carry VLAN traffic over a trunk link.

How to eliminate wrong answers

Option A is wrong because VTP (VLAN Trunking Protocol) is a Layer 2 messaging protocol used to synchronize VLAN information across switches, not a trunking encapsulation method; it is disabled by default on Nexus switches and not used to carry VLANs over a link. Option B is wrong because DTP (Dynamic Trunking Protocol) is a Cisco proprietary protocol used to negotiate trunking status between switch ports, but it does not encapsulate or carry VLAN traffic; it merely automates the establishment of a trunk link. Option C is wrong because ISL (Inter-Switch Link) is a Cisco proprietary trunking encapsulation that is not supported on Nexus switches; Nexus platforms use only 802.1Q for VLAN trunking.

Practice this question →

MCQhard

A data center engineer is configuring vPC on a pair of Cisco Nexus switches. The vPC peer-link is established but the vPC member ports remain suspended. After checking the configuration, the engineer notices that the vPC peer-keepalive link is not functioning. What is the most likely cause of the suspended member ports?

A.MTU mismatch on the peer-link

B.Peer-keepalive link failure causing dual-active detection issues

C.Mismatched vPC domain ID

D.Incorrect VLAN configuration on member ports

AnswerB

Peer-keepalive failure can trigger a dual-active situation, leading to member port suspension.

Why this answer

When the vPC peer-keepalive link fails, each vPC peer switch cannot detect whether the other peer is operational. This triggers the dual-active detection mechanism, causing the secondary switch to suspend its vPC member ports to prevent a split-brain scenario where both switches forward traffic for the same vPC VLAN. The suspended state is a protective measure until the peer-keepalive link is restored or the vPC role is resolved.

Exam trap

Cisco often tests the distinction between peer-link failure (which causes both switches to suspend member ports) and peer-keepalive failure (which causes only the secondary switch to suspend member ports), and the trap here is that candidates confuse the two or assume any link failure leads to the same outcome.

How to eliminate wrong answers

Option A is wrong because an MTU mismatch on the peer-link would cause packet drops or CRC errors, not the suspension of vPC member ports; the peer-link itself would still be up and vPC member ports would remain active. Option C is wrong because a mismatched vPC domain ID would prevent the vPC peer-link from forming at all, not cause member ports to suspend after the peer-link is established. Option D is wrong because incorrect VLAN configuration on member ports would cause traffic issues or ports to be in an err-disabled state, but the vPC member ports would not be suspended specifically due to VLAN misconfiguration; suspension is a vPC-specific state triggered by dual-active detection.

Practice this question →

MCQmedium

A data center spine-leaf architecture is designed to ensure low latency and high bandwidth. Which of the following best describes the role of the leaf switches in this topology?

A.Leaf switches are used only for management traffic and do not forward data-plane traffic.

B.Leaf switches provide the Layer 3 routing core and connect to external networks.

C.Leaf switches connect to servers and provide access to the network, while spine switches provide the aggregation and routing fabric.

D.Leaf switches interconnect all spine switches to provide any-to-any connectivity.

AnswerC

Correct. Leaf switches are access switches connecting servers; spine switches form the fabric.

Why this answer

In a spine-leaf architecture, leaf switches serve as the access layer that connects directly to servers, storage, and other endpoints. They forward traffic to spine switches, which provide the Layer 3 routing fabric and ensure any-to-any connectivity with predictable latency. This design eliminates the need for Spanning Tree Protocol (STP) and allows for efficient east-west traffic flow.

Exam trap

Cisco often tests the misconception that leaf switches perform routing and aggregation, when in fact they are access-layer switches that rely on spine switches for the Layer 3 fabric and external connectivity.

How to eliminate wrong answers

Option A is wrong because leaf switches are fully involved in forwarding data-plane traffic, not just management traffic; they handle all server-to-spine forwarding. Option B is wrong because leaf switches do not provide the Layer 3 routing core or connect to external networks—that role belongs to spine switches, which perform routing and often connect to the WAN or core. Option D is wrong because leaf switches do not interconnect spine switches; spine switches interconnect leaf switches to provide any-to-any connectivity, not the reverse.

Practice this question →

Multi-Selectmedium

Which TWO are benefits of using a spine-leaf architecture? (Choose two.)

Select 2 answers

A.Predictable and low latency

B.Scalability: adding more leaf switches does not require reconfiguration of existing ones

C.Eliminates need for VLANs

D.Simplified spanning-tree design

E.Reduced number of switch ports required

AnswersA, B

Each flow goes leaf-spine-leaf, constant hops.

Why this answer

In a spine-leaf architecture, every leaf switch connects to every spine switch, creating a full-mesh topology. This ensures that traffic between any two leaf switches traverses exactly one spine switch, resulting in predictable, low-latency forwarding because the number of hops is fixed and deterministic.

Exam trap

Cisco often tests the misconception that spine-leaf eliminates VLANs or simplifies spanning-tree, but the key trap is that candidates confuse 'no STP needed' with 'simplified STP design'—in reality, spine-leaf eliminates STP entirely by using Layer 3 routing between leaf and spine switches.

Practice this question →

MCQmedium

In a spine-leaf architecture with 40 leaf switches and 4 spine switches, each leaf has four 40G uplinks to the spines. What is the oversubscription ratio if each leaf has 48 ports of 10G for servers?

A.2:1

B.5:1

C.3:1

D.4:1

AnswerC

Correct: 480/160 = 3.

Why this answer

The oversubscription ratio is calculated by comparing total server bandwidth to total uplink bandwidth. Each leaf has 48 ports × 10G = 480G of server-facing bandwidth, and 4 uplinks × 40G = 160G of spine-facing bandwidth. The ratio is 480:160 = 3:1, meaning three times as much server bandwidth as uplink bandwidth, which is a common design target in Cisco ACI and NX-OS spine-leaf fabrics.

Exam trap

Cisco often tests the oversubscription ratio calculation by providing port counts and speeds, and the trap is that candidates mistakenly divide the total server bandwidth by the number of uplinks instead of the total uplink bandwidth, or they forget to multiply the number of uplinks by their speed.

How to eliminate wrong answers

Option A (2:1) is wrong because it would require 240G of uplink bandwidth (e.g., 6 × 40G uplinks), not the 160G provided. Option B (5:1) is wrong because it would imply 800G of server bandwidth, which is not the case with 48 × 10G ports. Option D (4:1) is wrong because it would require 120G of uplink bandwidth (e.g., 3 × 40G uplinks), but the actual uplink capacity is 160G, making the ratio 3:1, not 4:1.

Practice this question →

MCQmedium

What is the purpose of the vPC peer keepalive link in a vPC domain?

A.To synchronize MAC address tables

B.To carry BPDUs for STP

C.To provide a keepalive mechanism to detect peer failure

D.To forward data traffic between vPC peers

AnswerC

The keepalive link sends periodic messages to verify peer liveness.

Why this answer

The vPC peer keepalive link is a dedicated Layer 3 link used to detect a failure of the vPC peer switch. It sends periodic UDP-based keepalive messages (default every second) to ensure the peer is still operational, allowing the surviving switch to take over the vPC forwarding role. This mechanism is critical for preventing dual-active scenarios where both switches would incorrectly forward traffic for the same vPC VLAN.

Exam trap

Cisco often tests the distinction between the peer-link (which carries data and control traffic) and the peer keepalive link (which is only for liveness detection), and candidates mistakenly assume the keepalive link handles data or STP BPDUs.

How to eliminate wrong answers

Option A is wrong because MAC address synchronization between vPC peers is performed over the vPC peer-link (typically a port-channel), not the keepalive link; the keepalive link only carries heartbeat messages. Option B is wrong because BPDUs for STP are exchanged over the vPC peer-link or directly on member ports, not over the keepalive link, which is a Layer 3 path and does not participate in spanning tree. Option D is wrong because the keepalive link never forwards data traffic; it is a control-plane-only link used solely for peer liveness detection, while all data traffic between vPC peers traverses the peer-link.

Practice this question →

MCQmedium

Refer to the exhibit. An engineer configured a VXLAN tunnel endpoint (VTEP) but the VXLAN tunnel is not operational. The underlay OSPF adjacency is established. What is the missing configuration?

A.The NVE interface must be enabled with the no shutdown command.

B.The multicast group must be reachable via the underlay.

C.The loopback0 interface is not included in the OSPF process.

D.The VNI must be mapped to a VLAN.

AnswerC

The loopback0 interface, used as the NVE source, is not advertised via OSPF, so its IP is unreachable from other VTEPs.

Why this answer

The loopback0 interface is not included in the OSPF process. For VXLAN underlay routing, the VTEP source interface (typically loopback0) must be advertised via the underlay IGP (OSPF) so that remote VTEPs can reach it. Without this, the NVE interface cannot form a VXLAN tunnel even though OSPF adjacency is established, as the source IP is unreachable.

Exam trap

Cisco often tests the distinction between underlay routing adjacency and reachability of the VTEP source IP, leading candidates to overlook the need to advertise the loopback in OSPF.

How to eliminate wrong answers

Option A is wrong because the NVE interface is a virtual interface that does not require a 'no shutdown' command; it is automatically enabled when configured. Option B is wrong because the question does not mention multicast; VXLAN can use unicast (e.g., static or EVPN) for BUM traffic, and the underlay OSPF adjacency is already established, so multicast reachability is not the missing piece. Option D is wrong because VNI-to-VLAN mapping is only required for bridging traffic to local VLANs, not for the VXLAN tunnel itself to become operational.

Practice this question →

MCQeasy

In ACI, which object defines the logical separation of traffic within a tenant, analogous to a VLAN in traditional networking, and is associated with a VRF?

A.VRF

B.Application Profile

C.EPG

D.Bridge Domain

AnswerD

BD defines L2 domain, analogous to VLAN.

Why this answer

In Cisco ACI, a Bridge Domain (BD) defines the Layer 2 boundary and provides logical separation of traffic within a tenant, analogous to a VLAN in traditional networking. Each BD is associated with a VRF (Layer 3 context) to enable IP forwarding, and it encapsulates traffic using VXLAN (VNID) rather than 802.1Q VLAN tags.

Exam trap

Cisco often tests the distinction between EPG and Bridge Domain, trapping candidates who confuse the EPG's policy-group role with the BD's Layer 2 segmentation function.

How to eliminate wrong answers

Option A is wrong because a VRF is a Layer 3 construct that provides routing table separation, not Layer 2 segmentation; it is associated with a Bridge Domain, not the other way around. Option B is wrong because an Application Profile is a container for EPGs and their relationships, not a Layer 2 boundary; it does not define traffic separation at the data plane level. Option C is wrong because an EPG is a logical grouping of endpoints with common policy requirements, but it does not define the Layer 2 broadcast domain or VLAN-like separation; EPGs reside within a Bridge Domain.

Practice this question →

MCQhard

In a VXLAN EVPN fabric, BUM traffic can be handled by ingress replication or multicast. Which statement about ingress replication is accurate?

A.It requires PIM in the underlay to replicate packets.

B.The ingress VTEP replicates the BUM packet and sends unicast copies to each remote VTEP.

C.It reduces replication overhead on the ingress VTEP compared to multicast.

D.It uses IGMP snooping to optimize replication.

AnswerB

Correct: ingress replication creates unicast copies.

Why this answer

In ingress replication, the ingress VTEP (VXLAN Tunnel Endpoint) receives a BUM (Broadcast, Unknown unicast, Multicast) packet and creates multiple unicast-encapsulated copies, sending one copy to each remote VTEP in the same VXLAN network identifier (VNI) segment. This method does not rely on any multicast protocol in the underlay; instead, it leverages the VTEP's knowledge of all remote VTEPs (typically learned via the EVPN control plane, such as Type 3 Inclusive Multicast Ethernet Tag routes) to replicate traffic. Option B correctly describes this behavior.

Exam trap

Cisco often tests the misconception that ingress replication requires an underlay multicast protocol like PIM or IGMP, when in fact it is a unicast-based replication method that avoids any multicast dependency in the underlay.

How to eliminate wrong answers

Option A is wrong because ingress replication does not require Protocol Independent Multicast (PIM) in the underlay; PIM is only needed when using multicast-based replication in the underlay to distribute BUM traffic. Option C is wrong because ingress replication actually increases replication overhead on the ingress VTEP, as it must generate and send individual unicast copies to each remote VTEP, whereas multicast offloads replication to the underlay network devices. Option D is wrong because IGMP snooping is used to optimize multicast group membership in Layer 2 networks, not to optimize ingress replication; ingress replication relies on the EVPN control plane to discover remote VTEPs, not on IGMP snooping.

Practice this question →

Multi-Selecthard

When configuring BGP EVPN on spine switches functioning as route reflectors, which two address families must be configured? (Choose two.)

Select 2 answers

A.address-family link-state

B.address-family l2vpn evpn

C.address-family ipv6 unicast

D.address-family vpnv4

E.address-family ipv4 unicast

AnswersB, E

Required for EVPN route exchange.

Why this answer

B is correct because BGP EVPN (Ethernet VPN) uses the L2VPN address family (l2vpn evpn) to carry MAC/VXLAN routing information between spine and leaf switches. This address family is mandatory for EVPN control plane operation in a VXLAN fabric, enabling MAC address learning and advertisement via MP-BGP.

Exam trap

Cisco often tests the misconception that only the EVPN address family is needed, but the ipv4 unicast family is also required on the route reflector to advertise the underlay loopback routes that serve as VXLAN tunnel endpoints.

Practice this question →

MCQhard

After adding a new spine switch to a VXLAN EVPN fabric with OSPF underlay, some leaf switches experience routing instability. Which action could resolve the instability?

A.Increase the OSPF cost on the leaf-to-spine links.

B.Configure OSPF neighbor authentication.

C.Decrease the OSPF hello timer.

D.Enable OSPF route summarization on the leaves.

AnswerA

Higher cost makes the new spine less preferred, stabilizing routing.

Why this answer

When a new spine switch is added to a VXLAN EVPN fabric with an OSPF underlay, the leaf switches may experience routing instability because the new spine advertises routes with a lower cost, causing traffic to shift abruptly. Increasing the OSPF cost on the leaf-to-spine links makes those paths less preferred, stabilizing the routing table by preventing flapping and ensuring a more gradual convergence.

Exam trap

Cisco often tests the misconception that routing instability is caused by security or timer issues, when in fact it is typically due to unequal cost paths causing SPF thrashing after a new device is added.

How to eliminate wrong answers

Option B is wrong because OSPF neighbor authentication secures routing updates but does not address routing instability caused by cost-based path selection changes. Option C is wrong because decreasing the OSPF hello timer would increase the frequency of hello packets, potentially exacerbating instability by causing faster neighbor state changes and more frequent SPF calculations. Option D is wrong because enabling OSPF route summarization on the leaves reduces the size of the routing table but does not prevent the instability from a new spine advertising lower-cost routes; summarization affects route propagation, not path preference.

Practice this question →

MCQmedium

Refer to the exhibit. Which VLANs are allowed on the VPC peer-link?

A.VLANs 1-100 and native VLAN

B.Only VLAN 1

C.VLANs 1-100 only

D.All VLANs (1-4094)

AnswerC

The allowed VLAN range is 1-100.

Why this answer

In a vPC domain, the peer-link carries only specific VLANs that are allowed on the trunk. By default, the peer-link is configured as a trunk allowing VLANs 1-100, and the native VLAN is not included in this allowed list because the peer-link uses a dedicated VLAN for control traffic (typically VLAN 4094) and does not forward native VLAN traffic. Option C is correct because the default allowed VLAN list on a vPC peer-link is VLANs 1-100, as shown in the exhibit.

Exam trap

Cisco often tests the misconception that the vPC peer-link allows all VLANs or includes the native VLAN, when in fact it defaults to VLANs 1-100 and explicitly excludes the native VLAN to maintain control plane isolation.

How to eliminate wrong answers

Option A is wrong because the native VLAN is not allowed on the vPC peer-link; the peer-link uses a separate VLAN (often 4094) for control traffic and does not forward native VLAN frames. Option B is wrong because the peer-link allows more than just VLAN 1; it permits VLANs 1-100 by default. Option D is wrong because the peer-link does not allow all VLANs (1-4094); it is restricted to VLANs 1-100 by default to prevent unnecessary traffic and loops.

Practice this question →

Multi-Selectmedium

An engineer is implementing VXLAN with a centralized routing gateway. Which TWO statements are correct about BUM traffic handling?

Select 2 answers

A.Multicast in the underlay is always required for BUM traffic

B.Ingress replication sends a copy of the BUM packet to each remote VTEP via unicast

C.Ingress replication consumes more bandwidth on the source VTEP uplinks than multicast

D.Only the ingress VTEP handles BUM traffic

E.BUM traffic is never flooded to all VTEPs

AnswersB, C

Ingress replication encapsulates each copy as unicast.

Why this answer

In a VXLAN centralized routing gateway deployment, ingress replication is a valid method for handling BUM traffic where the ingress VTEP sends a unicast copy of the BUM packet to each remote VTEP. This is correct because it eliminates the need for multicast in the underlay, making option B accurate. Ingress replication consumes more bandwidth on the source VTEP uplinks than multicast because it generates multiple unicast copies, whereas multicast sends a single stream that is replicated by the network, making option C correct.

Exam trap

Cisco often tests the misconception that multicast is mandatory for VXLAN BUM traffic, but the trap here is that ingress replication is a valid alternative that avoids multicast complexity, and candidates may incorrectly assume multicast is always required.

Practice this question →

MCQmedium

Refer to the exhibit. A VXLAN VNI (10030) is operationally down. What is the most likely cause?

A.The source interface loopback0 is not up

B.The NVE mode should be L2VPN instead of L3VPN

C.The VLAN associated with VNI 10030 is not configured or mapped

D.The multicast group 239.1.1.1 is not reachable

AnswerC

The VNI must be mapped to a VLAN using 'vn-segment vlan-id' under the VLAN configuration; missing mapping causes operational down.

Why this answer

VXLAN VNI 10030 is operationally down because the VLAN that maps to this VNI is either not created or not associated with the VNI under the NVE interface. In Cisco NX-OS, a VNI becomes operationally up only when the corresponding VLAN exists and is properly mapped via the `member vni 10030 associate-vrf` or `member vni 10030` command under the NVE interface. Without this mapping, the NVE cannot forward traffic for that VNI, leaving it in a down state.

Exam trap

Cisco often tests the misconception that a VNI goes down due to multicast reachability or source interface issues, but the actual cause is the missing VLAN-to-VNI mapping, which is a common misconfiguration in VXLAN deployments.

How to eliminate wrong answers

Option A is wrong because if the source interface loopback0 were not up, the NVE interface itself would be down or the VXLAN tunnel would fail, but the VNI operational state would show as 'down' due to the source interface issue, not specifically because of a missing VLAN mapping. Option B is wrong because the NVE mode can be either L2VPN or L3VPN depending on the deployment; VXLAN VNI 10030 being operationally down is unrelated to the NVE mode, and L3VPN mode is correct for VXLAN EVPN with Layer 3 VNI. Option D is wrong because the multicast group 239.1.1.1 is used for BUM traffic replication; if it were unreachable, the VNI might still be operationally up but unable to forward broadcast traffic, so it would not cause the VNI to be operationally down.

Practice this question →

MCQeasy

Which NX-OS command is used to display the current OSPF neighbor states?

A.show ip route ospf

B.show ospf database

C.show ip ospf neighbors

D.show ip ospf interface

AnswerC

This command displays OSPF neighbor states and adjacency details.

Why this answer

The 'show ip ospf neighbors' command is the correct NX-OS command to display the current OSPF neighbor states, including the neighbor ID, interface, state (e.g., FULL, 2WAY, DOWN), and adjacency details. This command directly queries the OSPF process for the neighbor state machine, which is essential for verifying OSPF adjacency formation and troubleshooting Layer 3 connectivity.

Exam trap

Cisco often tests the distinction between commands that show neighbor states versus those that show routing tables or database contents, so candidates may confuse 'show ip route ospf' or 'show ospf database' with the neighbor-specific command.

How to eliminate wrong answers

Option A is wrong because 'show ip route ospf' displays the OSPF-learned routes in the routing table, not the neighbor states or adjacency information. Option B is wrong because 'show ospf database' shows the contents of the OSPF link-state database (LSDB), including LSAs, but does not provide neighbor state or adjacency details. Option D is wrong because 'show ip ospf interface' displays OSPF parameters and operational status for each interface (e.g., area, cost, timers), but does not show the neighbor state table.

Practice this question →

Multi-Selecthard

A network team is troubleshooting a vPC issue where one of the member ports is not coming up. Which TWO conditions can cause a vPC member port to fail consistency checks? (Select two.)

Select 2 answers

A.Different STP port type (edge vs network)

B.Spanning-tree guard root configured on one peer

C.Mismatched allowed VLANs on the port channel

D.Incorrect peer keepalive IP

E.Different MTU settings on the peer-link

AnswersA, C

STP port type must match on both peers for the same port.

Why this answer

VPC performs consistency checks on member ports to ensure both peers have identical configurations for certain parameters. A mismatch in STP port type (e.g., one peer configured as 'edge' and the other as 'network') will cause the vPC member port to fail the consistency check and remain down, as STP port type affects BPDU handling and loop prevention.

Exam trap

Cisco often tests the distinction between parameters that are checked for vPC consistency (like STP port type and allowed VLANs) versus those that are not (like root guard or peer keepalive), leading candidates to select options that sound plausible but are not part of the consistency check list.

Practice this question →

Multi-Selecthard

In an ACI fabric, a tenant is configured with multiple bridge domains (BDs) and EPGs. Which three statements correctly describe the ACI model? (Choose three.)

Select 3 answers

A.Contracts are applied between EPGs to allow communication.

B.A VRF is equivalent to a Layer 3 domain within a tenant.

C.EPGs can communicate with each other without any contract.

D.An EPG belongs to a single bridge domain.

E.L3Out is used to connect the ACI fabric to external Layer 2 networks.

AnswersA, B, D

Correct. Contracts define allowed traffic directions and filters.

Why this answer

In ACI, contracts are the mechanism used to enable communication between EPGs. By default, all traffic is denied, and a contract must be explicitly applied to allow traffic flow between EPGs, enforcing a zero-trust model.

Exam trap

Cisco often tests the misconception that EPGs can communicate freely without contracts, but the correct ACI model requires contracts for any inter-EPG traffic, even within the same bridge domain.

Practice this question →

MCQmedium

Which NX-OS command displays the VPC status, including peer-link and consistency parameters?

A.show vpc brief

B.show vpc peer-link

C.show vpc consistency

D.show vpc

AnswerD

This command gives comprehensive VPC status.

Why this answer

The 'show vpc' command (without any keyword) displays the overall Virtual Port Channel (vPC) status, including peer-link status, consistency parameters, and per-VLAN/vPC operational state. This is the most comprehensive single command for verifying vPC health and configuration consistency between peer switches.

Exam trap

Cisco often tests the misconception that 'show vpc brief' or 'show vpc peer-link' alone provide full vPC health details, when in fact only the base 'show vpc' command reveals all critical consistency and peer-link parameters in one view.

How to eliminate wrong answers

Option A is wrong because 'show vpc brief' provides a summary of vPC member ports and their status, but does not include peer-link or consistency parameters. Option B is wrong because 'show vpc peer-link' only shows the status of the peer-link itself (e.g., port-channel, keepalive), not the broader consistency parameters. Option C is wrong because 'show vpc consistency' is not a valid NX-OS command; consistency parameters are displayed as part of 'show vpc' output, not via a separate command.

Practice this question →

MCQhard

A data center architect is designing a spine-leaf network with 40 leaf switches and 8 spine switches. Each leaf has 40x25G downlinks to servers and 8x100G uplinks to spines. The oversubscription ratio from server to spine is calculated as (total downlink bandwidth) / (total uplink bandwidth). What is the oversubscription ratio for each leaf?

A.1.5:1

B.2:1

C.0.8:1

D.1.25:1

AnswerD

1000/800 = 1.25:1.

Why this answer

The oversubscription ratio for each leaf is calculated by dividing the total downlink bandwidth by the total uplink bandwidth. Each leaf has 40 downlinks at 25 Gbps each, totaling 1000 Gbps, and 8 uplinks at 100 Gbps each, totaling 800 Gbps. Thus, 1000 / 800 = 1.25, giving a 1.25:1 ratio.

Exam trap

Cisco often tests the oversubscription calculation by providing link counts and speeds, and the trap here is that candidates may forget to multiply the number of links by their respective speeds before dividing, or they may invert the numerator and denominator.

How to eliminate wrong answers

Option A (1.5:1) is wrong because it might result from incorrectly using 40 downlinks at 25 Gbps (1000 Gbps) versus 8 uplinks at 100 Gbps (800 Gbps) but miscalculating the division as 1200/800 or similar. Option B (2:1) is wrong because it could stem from confusing the number of links (e.g., 40 downlinks vs. 20 uplinks) or misapplying a common 2:1 oversubscription ratio used in other designs. Option C (0.8:1) is wrong because it inverts the calculation (800/1000) or assumes the uplink bandwidth exceeds the downlink bandwidth, which is not the case here.

Practice this question →

Multi-Selectmedium

An ACI administrator is configuring external connectivity using L3Out. Which THREE components must be defined for a successful L3Out deployment? (Select three.)

Select 3 answers

A.External routed network (L3Out)

B.VMM domain

C.Service graph

D.Contract between external EPG and internal EPG

E.Context (VRF) and Bridge Domain (BD) for the external network

AnswersA, D, E

This defines the external connectivity.

Why this answer

The external routed network (L3Out) is the fundamental construct that defines the Layer 3 connectivity from the ACI fabric to an external router or network. It specifies the routing protocol (e.g., OSPF, BGP, or static), the external interfaces, and the protocol policies required for the ACI spine switches to exchange routes with external devices. Without defining the L3Out object, the fabric has no configured path or policy to reach external destinations.

Exam trap

Cisco often tests the misconception that a VMM domain or service graph is mandatory for L3Out, when in fact only the L3Out object, the contract between external and internal EPGs, and the VRF/BD for the external network are strictly required.

Practice this question →

MCQhard

In a VXLAN EVPN fabric, a new server is connected to a leaf switch and requires Layer 2 connectivity to an existing VM on a different leaf. The engineer notes that the VTEP on the new leaf does not have a Type-2 route for the VM's MAC address. Which EVPN route type is used to advertise MAC addresses?

A.Type-5 (IP Prefix)

B.Type-1 (Ethernet Auto-discovery)

C.Type-2 (MAC/IP Advertisement)

D.Type-3 (Inclusive Multicast Ethernet Tag)

AnswerC

Type-2 advertises MAC and optionally IP addresses.

Why this answer

In VXLAN EVPN fabrics, Type-2 (MAC/IP Advertisement) routes are specifically used to advertise MAC addresses and their associated IP addresses between VTEPs. When a new leaf switch needs Layer 2 connectivity to a VM on a different leaf, it must learn the VM's MAC address via a Type-2 route from the remote VTEP. Without this route, the new leaf cannot populate its MAC table for that VM, preventing Layer 2 communication.

Exam trap

Cisco often tests the distinction between Type-2 (MAC/IP) and Type-3 (IMET) routes, and the trap here is that candidates confuse the route used for BUM flooding (Type-3) with the route used for unicast MAC advertisement (Type-2), leading them to incorrectly select Type-3.

How to eliminate wrong answers

Option A is wrong because Type-5 (IP Prefix) routes are used to advertise external IP prefixes (e.g., from a WAN or data center interconnect) and do not carry MAC address information; they are for Layer 3 VPN-like prefix distribution. Option B is wrong because Type-1 (Ethernet Auto-discovery) routes are used for redundancy group membership and split-horizon filtering (e.g., ESI label distribution), not for advertising individual MAC addresses. Option D is wrong because Type-3 (Inclusive Multicast Ethernet Tag) routes are used to build the BUM (Broadcast, Unknown unicast, Multicast) tunnel overlay for flooding traffic, not to advertise specific MAC-to-VTEP mappings.

Practice this question →

Multi-Selecthard

An engineer is deploying an ACI fabric with VMM integration for VMware vSphere. Which THREE components must be configured to enable dynamic EPG assignment based on VM attributes? (Choose three.)

Select 3 answers

A.APIC cluster IP

B.VMM domain

C.vCenter credentials

D.Port group mapping to EPG

E.L3Out configuration

AnswersB, C, D

Defines the integration with vCenter.

Why this answer

The VMM domain (Option B) is the core integration object that defines the VMware vCenter connection and policy enforcement boundary. It must be configured to enable the APIC to discover VMs and their attributes, which is the prerequisite for dynamic EPG assignment based on VM properties such as VM name, OS type, or custom tags.

Exam trap

Cisco often tests the misconception that the APIC cluster IP (Option A) is required for VMM integration, but it is only needed for initial fabric discovery; the VMM domain, vCenter credentials, and port group mapping are the three mandatory components for dynamic EPG assignment.

Practice this question →

Multi-Selecteasy

An engineer is deploying a new application in an ACI fabric. Which two objects must be created to define a network policy? (Choose two.)

Select 2 answers

A.VRF

B.External routed network

C.Bridge Domain

D.Tenant

E.VMM domain

AnswersC, D

BD defines Layer 2 boundary.

Why this answer

In Cisco ACI, a network policy is defined by the combination of a Tenant and a Bridge Domain. The Tenant is the top-level container that isolates policies and configurations, while the Bridge Domain defines the Layer 2 forwarding boundary and associates the subnet, enabling communication within the fabric. Without these two objects, a network policy cannot be fully realized.

Exam trap

Cisco often tests the misconception that a VRF alone defines the network policy, but the VRF is only the routing context; the Bridge Domain and Tenant are the mandatory objects for the Layer 2 and administrative boundaries.

Practice this question →

MCQmedium

In VXLAN, what is the role of the VNI in the overlay network?

A.Identifies the VTEP

B.Encapsulation type

C.Identifies the overlay network segment

D.Specifies the underlay VRF

AnswerC

VNI maps to a Layer 2 segment.

Why this answer

The VNI (VXLAN Network Identifier) is a 24-bit field in the VXLAN header that uniquely identifies a Layer 2 overlay network segment, analogous to a VLAN ID in traditional networking. It allows multiple tenants or broadcast domains to coexist over a shared underlay network by isolating traffic at the overlay level.

Exam trap

The trap here is that candidates confuse the VNI with the VLAN ID or think it identifies the VTEP, but Cisco tests that the VNI specifically identifies the overlay network segment, not the endpoint or encapsulation method.

How to eliminate wrong answers

Option A is wrong because the VTEP (VXLAN Tunnel Endpoint) is identified by its IP address, not the VNI; the VNI identifies the network segment, not the tunnel endpoint. Option B is wrong because the encapsulation type is VXLAN itself (UDP-based), and the VNI is a field within the encapsulation header, not the type. Option D is wrong because the underlay VRF is a routing/forwarding instance in the underlay network, while the VNI operates at the overlay layer and does not specify any underlay VRF.

Practice this question →

MCQmedium

A data center engineer is troubleshooting intermittent connectivity between two servers in different VLANs. The servers are connected to different leaf switches in a VXLAN EVPN fabric. When checking the fabric, the engineer notices that the NVE interface on one leaf is up/up but the VNI for the server VLAN is not listed in 'show nve vni'. What is the most likely cause?

A.MTU mismatch on the underlay network

B.Anycast gateway is not configured on the leaf

C.BGP EVPN peers are not established

D.The VLAN-to-VNI mapping is missing under the VLAN configuration

AnswerD

The VNI must be mapped to a VLAN using 'vn-segment vlan-id' under the VLAN configuration; without it, the VNI does not appear in the NVE interface.

Why this answer

The NVE interface being up/up indicates the overlay tunnel is operational, but the absence of the VNI in 'show nve vni' means the VNI is not instantiated on the NVE. This typically occurs when the VLAN-to-VNI mapping is missing under the VLAN configuration (e.g., 'vlan 100' then 'vn-segment 10100'), which prevents the VNI from being associated with the NVE interface and advertised via BGP EVPN.

Exam trap

Cisco often tests the distinction between the NVE interface being operational (up/up) and the VNI being properly instantiated via VLAN-to-VNI mapping, leading candidates to incorrectly suspect BGP or underlay issues when the real problem is a missing local configuration step.

How to eliminate wrong answers

Option A is wrong because an MTU mismatch on the underlay network would cause packet drops or fragmentation, not the absence of a VNI from the NVE VNI list. Option B is wrong because anycast gateway configuration (e.g., 'ip virtual-router address' or 'fabric forwarding anycast-gateway-mac') is used for first-hop redundancy and does not affect whether a VNI appears in 'show nve vni'. Option C is wrong because BGP EVPN peers not being established would prevent route exchange but would not prevent the VNI from being locally instantiated on the NVE; the VNI would still appear in 'show nve vni' even if peers are down.

Practice this question →

MCQhard

During a maintenance window, a network engineer plans to upgrade the NX-OS software on a pair of Nexus 9000 switches configured as vPC peers. The engineer wants to minimize traffic disruption. Which upgrade sequence is recommended?

A.Upgrade both switches simultaneously using ISSU

B.Reload both switches to a previous version, then upgrade

C.Upgrade the primary vPC peer first, then the secondary

D.Upgrade the secondary vPC peer first, then the primary

AnswerD

Upgrading secondary first ensures the primary remains operational; after secondary upgrade, it can take over if needed during primary upgrade.

Why this answer

In a vPC pair, the secondary peer is upgraded first to preserve the primary's role as the forwarding anchor. Upgrading the secondary peer allows it to reboot and rejoin the vPC domain without disrupting the data plane because the primary peer continues to forward traffic. Once the secondary is stable, the primary is upgraded, ensuring minimal traffic loss.

Exam trap

Cisco often tests the misconception that upgrading the primary first is safer because it is the 'leader,' but the correct sequence is to upgrade the secondary first to avoid a disruptive role transition.

How to eliminate wrong answers

Option A is wrong because ISSU (In-Service Software Upgrade) is not supported on Nexus 9000 switches in vPC mode; it requires non-disruptive upgrades which are not available for vPC peer links. Option B is wrong because reloading both switches to a previous version would cause a complete traffic outage, defeating the goal of minimizing disruption. Option C is wrong because upgrading the primary vPC peer first would cause the primary to reboot, leading to a vPC role change and potential traffic black-holing until the secondary takes over, increasing disruption.

Practice this question →

MCQmedium

In a VXLAN overlay, which encapsulation is used to transport Ethernet frames over the IP network?

A.IPsec

B.TCP

C.GRE

D.UDP

AnswerD

VXLAN uses UDP (port 4789).

Why this answer

VXLAN uses UDP encapsulation (destination port 4789 by default) to transport Layer 2 Ethernet frames over a Layer 3 IP network. This allows the overlay to leverage existing IP routing infrastructure while preserving the original MAC addresses and VLAN information, enabling network virtualization and scalability beyond traditional VLAN limits.

Exam trap

Cisco often tests the misconception that VXLAN uses GRE or TCP encapsulation because of its tunneling nature, but the key is that VXLAN specifically uses UDP to allow stateless, scalable overlay transport and to leverage existing IP routing without TCP's connection overhead.

How to eliminate wrong answers

Option A is wrong because IPsec is a security protocol used for encrypting and authenticating IP packets, not for encapsulating Ethernet frames in a VXLAN overlay. Option B is wrong because TCP is a connection-oriented transport protocol that would introduce unnecessary overhead and retransmission delays, whereas VXLAN relies on UDP for stateless, low-latency encapsulation. Option C is wrong because GRE is a tunneling protocol that can encapsulate various protocols, but VXLAN specifically uses UDP as its transport mechanism to leverage ECMP load balancing and avoid the overhead of GRE headers.

Practice this question →

MCQmedium

An engineer is deploying a VXLAN overlay network in a data center using Cisco Nexus 9000 series switches. The network must handle BUM traffic efficiently across the fabric. Which method for BUM traffic handling requires the VTEP to maintain a list of all remote VTEPs and replicate packets individually?

A.Multicast-based replication

B.Suppression of BUM traffic

C.Head-end replication

D.Ingress replication

AnswerD

Ingress replication requires the source VTEP to replicate packets to each remote VTEP individually.

Why this answer

Ingress replication (Option D) is the correct method because it requires the ingress VTEP to maintain a list of all remote VTEPs in the VXLAN segment and replicate each BUM packet individually to each remote VTEP. This is a unicast-based replication approach that does not rely on multicast in the underlay, making it suitable for networks where multicast is not enabled or desired.

Exam trap

Cisco often tests the distinction between 'ingress replication' and 'multicast-based replication' by describing the behavior of the ingress VTEP maintaining a list and replicating individually, which directly maps to ingress replication, not multicast.

How to eliminate wrong answers

Option A is wrong because multicast-based replication uses an underlay multicast group (e.g., PIM-SM) to distribute BUM traffic to all VTEPs that have joined the group, without requiring the ingress VTEP to maintain a list of remote VTEPs or replicate packets individually. Option B is wrong because suppression of BUM traffic (e.g., ARP suppression) reduces the amount of BUM traffic by caching known MAC-to-IP mappings, but it does not define the replication method for traffic that is not suppressed. Option C is wrong because head-end replication is a generic term sometimes used interchangeably with ingress replication, but in Cisco VXLAN documentation, the specific term for the VTEP maintaining a list and replicating individually is 'ingress replication'.

Practice this question →

MCQhard

A network engineer is configuring an ACI contract between an EPG and an external EPG. Which construct is used to permit traffic from the external EPG to the internal EPG?

A.The internal EPG is the provider and the external EPG is the consumer.

B.Both EPGs are providers.

C.Both EPGs are consumers.

D.The external EPG is the provider and the internal EPG is the consumer.

AnswerD

Correct direction for inbound traffic.

Why this answer

In Cisco ACI, the provider EPG exposes a contract, and the consumer EPG consumes it. To permit traffic from an external EPG to an internal EPG, the internal EPG must be the consumer (initiating the communication) and the external EPG must be the provider (offering the contract). This aligns with the default directionality of contracts, where the provider's filter rules allow inbound traffic from the consumer.

Exam trap

Cisco often tests the misconception that the provider is always the server or internal resource, but in ACI, the provider is the entity that offers the contract and defines the traffic direction, which can be the external EPG when allowing inbound traffic.

How to eliminate wrong answers

Option A is wrong because if the internal EPG is the provider and the external EPG is the consumer, the contract would permit traffic initiated from the internal EPG to the external EPG, not the reverse. Option B is wrong because both EPGs cannot be providers simultaneously; a contract requires one provider and one consumer to define the direction of traffic flow. Option C is wrong because both EPGs cannot be consumers; a contract must have at least one provider to expose the filter rules.

Practice this question →

MCQhard

A large enterprise uses Cisco Nexus 9000 switches in a VXLAN EVPN fabric. The underlay is OSPF. Each leaf switch has a loopback0 interface as the source interface for VXLAN tunnel endpoints. After a maintenance window, an engineer modifies the IP address of loopback0 on leaf-5 from 10.1.1.5/32 to 10.1.1.105/32. Subsequently, all VXLAN tunnels to leaf-5 go down. OSPF adjacencies between leaf-5 and the spines are still FULL. The engineer checks the NVE interface on leaf-5 and sees the source-interface is loopback0 but the interface status is up/up. However, pings from other leaves to 10.1.1.105 fail. What is the most likely cause?

A.The OSPF process on leaf-5 was not restarted after the IP change

B.The new loopback IP 10.1.1.105 is not included in the OSPF network statement under router ospf

C.The MTU on loopback0 is set too low causing OSPF hello drops

D.The VXLAN source-interface was automatically changed to a different loopback

AnswerB

The new IP subnet must be advertised via OSPF to be reachable by other leaves.

Why this answer

After changing the loopback0 IP address on leaf-5, the new IP 10.1.1.105/32 must be explicitly advertised into OSPF for other leaves to reach it. If the OSPF network statement under router ospf still references the old subnet or does not include 10.1.1.105/32, the route for this new loopback IP will not be installed in the OSPF database. Consequently, other leaves cannot route to the new VTEP IP, causing VXLAN tunnels to fail even though OSPF adjacencies remain FULL (since adjacencies are formed over physical interfaces, not the loopback).

Exam trap

Cisco often tests the distinction between OSPF adjacency status (which relies on physical interfaces) and route advertisement (which depends on network statements covering the loopback IP), leading candidates to incorrectly assume that FULL adjacencies guarantee reachability to the VTEP IP.

How to eliminate wrong answers

Option A is wrong because restarting the OSPF process is not required after a loopback IP change; OSPF dynamically detects interface IP changes and updates LSAs accordingly, provided the new IP is covered by an existing network statement. Option C is wrong because MTU misconfiguration on loopback0 would not selectively cause OSPF hello drops only after an IP change; OSPF hellos are sent over the physical underlay interfaces, not the loopback, and a low MTU on loopback0 would not affect OSPF adjacencies that are already FULL. Option D is wrong because the VXLAN source-interface is explicitly configured under the NVE interface and does not automatically change; the engineer confirmed the source-interface remains loopback0 and the NVE interface is up/up.

Practice this question →

MCQmedium

An engineer is implementing VXLAN in a data center. The network must handle BUM traffic without relying on IP multicast in the underlay. Which BUM handling method should be chosen?

A.ARP suppression

B.Head-end replication

C.Multicast group

D.Ingress replication

AnswerD

Ingress replication uses unicast tunnels to replicate BUM traffic, no multicast needed.

Why this answer

In VXLAN environments that must avoid IP multicast in the underlay, ingress replication is the correct BUM handling method. It replicates broadcast, unknown unicast, and multicast (BUM) traffic at the ingress VTEP and sends a copy to each remote VTEP via unicast encapsulation, eliminating the need for multicast group membership in the underlay.

Exam trap

Cisco often tests the distinction between 'ingress replication' and 'head-end replication'—while they are functionally similar, the exam expects 'Ingress replication' as the correct Cisco term for unicast-only BUM handling, and 'Head-end replication' is a distractor that may confuse candidates into thinking it is a different method.

How to eliminate wrong answers

Option A is wrong because ARP suppression is a feature that reduces broadcast traffic by caching ARP replies at the VTEP, but it does not handle all BUM traffic (e.g., unknown unicast or multicast) and still requires a BUM replication method for traffic that is not suppressed. Option B is wrong because head-end replication is a generic term that can refer to ingress replication, but in Cisco VXLAN documentation, 'head-end replication' is often used interchangeably with ingress replication; however, the specific answer choice 'Head-end replication' is ambiguous and not the standard Cisco term for the unicast-only BUM method—Cisco explicitly uses 'Ingress replication' in the 350-601 exam context. Option C is wrong because multicast group relies on IP multicast in the underlay (e.g., PIM), which the question explicitly states must be avoided.

Practice this question →

Multi-Selectmedium

A network engineer is planning to implement VPC in a Cisco Nexus data center. Which two statements about VPC components are true? (Choose two.)

Select 2 answers

A.VPC member ports can be configured on only one of the VPC peers to avoid loops.

B.VPC consistency checks ensure that both peers have identical configurations for VPC member ports.

C.The VPC peer-keepalive link is used to monitor the liveness of the VPC peer.

D.VPC requires an IGP routing protocol between the peers to exchange MAC addresses.

E.The VPC peer-link carries only control-plane traffic between the VPC peers.

AnswersB, C

Correct. Consistency checks prevent misconfigurations that could cause loops.

Why this answer

VPC consistency checks are a critical feature that ensures both VPC peers have identical configurations for member ports, such as VLANs, allowed VLAN lists, and interface parameters. If configurations diverge, the VPC will suspend member ports to prevent traffic disruption or loops. This check is performed via the Cisco NX-OS Consistency Checker, which validates parameters like STP settings, port type, and allowed VLANs.

Exam trap

Cisco often tests the misconception that the peer-link carries only control-plane traffic, but in reality it also carries data-plane traffic for orphan ports and traffic that needs to reach the other VPC peer.

Practice this question →

MCQmedium

Refer to the exhibit. A network engineer notices that the VPC peer status is down, and the peer-keepalive is not reachable. Based on the configuration, what is the likely issue?

A.The peer-link port-channel10 has VLAN 100-110 allowed, but the peer-keepalive uses a separate VLAN.

B.The peer-keepalive destination must be on the management VRF.

C.The VPC domain priority should be lower.

D.The peer-keepalive source and destination are swapped.

AnswerB

Nexus requires the peer-keepalive to be sent via the management VRF, which is not specified here. The command should include 'vrf management'.

Why this answer

The peer-keepalive link must be routed via the management VRF to ensure it remains independent of the data-plane and peer-link state. If the peer-keepalive destination is not in the management VRF, the keepalive packets may be dropped or unreachable, causing the VPC peer status to remain down. The configuration shown likely omits the 'vrf member management' under the peer-keepalive configuration, or the destination IP is not reachable through the management interface.

Exam trap

Cisco often tests the requirement that peer-keepalive must use the management VRF (or a dedicated VRF) and not rely on the peer-link or any data VLAN, leading candidates to incorrectly focus on VLAN allowed lists or priority values instead of the VRF configuration.

How to eliminate wrong answers

Option A is wrong because the peer-link port-channel VLAN allowed list does not affect peer-keepalive reachability; peer-keepalive uses a separate Layer 3 path (typically management VRF) and is not dependent on the VLANs allowed on the peer-link. Option C is wrong because the VPC domain priority determines which switch is the primary for role election, not the peer-keepalive status; a lower priority would not fix an unreachable peer-keepalive destination. Option D is wrong because swapping the source and destination IP addresses would still result in an unreachable path if the destination is not in the correct VRF; the core issue is the VRF mismatch, not the direction of the addresses.

Practice this question →

Multi-Selectmedium

Which TWO statements about VXLAN BGP EVPN control plane are true? (Choose two.)

Select 2 answers

A.The underlay network provides IP connectivity between VTEPs

B.BGP EVPN advertises MAC addresses and IP addresses as routes

C.VXLAN encapsulates Ethernet frames in IP packets using MPLS labels

D.VXLAN uses a 32-bit network identifier (VNI)

E.The control plane is responsible for actual data forwarding

AnswersA, B

Underlay routing (e.g., IS-IS, OSPF) enables VTEP-to-VTEP reachability.

Why this answer

The VXLAN underlay network (typically an IP-based fabric using protocols like OSPF or IS-IS) provides IP connectivity between VTEPs, enabling them to encapsulate and decapsulate VXLAN packets. Without this underlay reachability, VTEPs cannot communicate, making it a foundational requirement for VXLAN operation.

Exam trap

Cisco often tests the distinction between the 24-bit VNI (VXLAN Network Identifier) and the 32-bit VXLAN segment ID used in some older documentation, leading candidates to mistakenly select a 32-bit identifier.

Practice this question →

MCQmedium

In ACI, what is the purpose of a contract?

A.Isolate tenants

B.Define routing between VRF

C.Allow or deny traffic between EPGs

D.Provide external connectivity

AnswerC

Contracts are the policy mechanism.

Why this answer

In Cisco ACI, a contract is a policy construct that defines how communication is allowed or denied between Endpoint Groups (EPGs). Contracts specify the subjects, filters, and actions (permit or deny) that govern traffic flows, enabling granular security and segmentation within the fabric. Without a contract, EPGs in different bridge domains or VRFs cannot communicate by default.

Exam trap

Cisco often tests the misconception that contracts are used for routing or tenant isolation, when in fact they are strictly a policy mechanism for traffic filtering between EPGs, not a routing or tenancy construct.

How to eliminate wrong answers

Option A is wrong because isolating tenants is achieved through tenant constructs and VRFs, not contracts; contracts control inter-EPG traffic, not tenant isolation. Option B is wrong because routing between VRFs is handled by a VRF route leak or a routed outside connection, not by a contract; contracts operate at Layer 4–7 policy level, not Layer 3 routing. Option D is wrong because external connectivity is provided by external routed networks (L3Out) or Layer 2 outside (L2Out) configurations, not by contracts; contracts only define policy for traffic between EPGs or between an EPG and an external network.

Practice this question →

MCQhard

In a Cisco ACI fabric, the administrator notices that traffic between two endpoints in different EPGs but on the same leaf switch is being dropped when a contract is applied. The endpoints are in the same VRF but different bridge domains. What is the likely cause?

A.The VRF is not configured correctly.

B.The bridge domains are not in the same network.

C.The leaf switch is missing a route to the destination.

D.The contract does not allow communication between those EPGs.

AnswerD

Contracts must explicitly permit inter-EPG traffic.

Why this answer

In Cisco ACI, inter-EPG communication is governed by contracts. Even when endpoints reside on the same leaf switch, same VRF, and different bridge domains, traffic is dropped unless a contract explicitly permits the communication between the source and destination EPGs. The contract defines the filter (e.g., IP protocol, ports) and the direction (provider/consumer) required for traffic to flow.

Exam trap

Cisco often tests the misconception that endpoints in the same VRF can always communicate, but in ACI, contracts override Layer 3 reachability, and candidates mistakenly blame routing or subnet mismatches instead of the missing contract.

How to eliminate wrong answers

Option A is wrong because the VRF configuration is irrelevant; both endpoints are in the same VRF, and the issue is not about VRF reachability but about policy enforcement. Option B is wrong because bridge domains can be in different subnets; ACI routes between them using the VRF, and the contract is the gatekeeper, not the subnet. Option C is wrong because the leaf switch does not need a separate route; ACI uses a distributed anycast gateway and the leaf already has the endpoint's location learned via COOP, so routing is not the issue.

Practice this question →

MCQmedium

Which Cisco DCNM feature allows centralized management and monitoring of multiple NX-OS fabrics?

A.vCenter

B.NX-API

C.APIC controller

D.DCNM

AnswerD

DCNM manages multiple NX-OS fabrics centrally.

Why this answer

Cisco DCNM (Data Center Network Manager) is the correct answer because it is the centralized management platform specifically designed to manage, monitor, and provision multiple NX-OS fabrics, including LAN and SAN, from a single pane of glass. It supports fabric discovery, configuration compliance, and health monitoring across multiple switches and fabrics, which aligns directly with the question's requirement.

Exam trap

Cisco often tests the distinction between management platforms (DCNM) and controllers (APIC), so the trap here is that candidates confuse APIC (for ACI) with DCNM (for NX-OS fabrics), especially since both are Cisco data center management tools.

How to eliminate wrong answers

Option A (vCenter) is wrong because it is VMware's management tool for vSphere environments, not a Cisco DCNM feature; it manages virtual machines and ESXi hosts, not NX-OS fabrics. Option B (NX-API) is wrong because it is a programmatic interface (REST API) on NX-OS switches for automation and configuration, not a centralized management platform for multiple fabrics. Option C (APIC controller) is wrong because it is the controller for Cisco ACI (Application Centric Infrastructure) fabrics, not for traditional NX-OS fabrics; APIC manages ACI leaf/spine topologies, not standalone NX-OS switches or fabrics.

Practice this question →

MCQhard

An engineer is designing an ACI fabric and needs to provide connectivity to an external Layer 3 network. Which construct must be configured to achieve this?

A.VMM domain

B.EPG

C.L3Out

D.VXLAN tunnel

AnswerC

L3Out provides external Layer 3 connectivity via routed interfaces or subinterfaces.

Why this answer

To connect an ACI fabric to an external Layer 3 network, you must configure an L3Out. An L3Out defines the external routed connectivity by associating a VRF with external interfaces, routing protocols (e.g., OSPF, BGP, EIGRP), and subnets that are advertised into or from the fabric. This construct allows ACI to exchange routes with the external Layer 3 domain.

Exam trap

Cisco often tests the distinction between internal fabric constructs (EPGs, VMM domains) and external connectivity constructs (L3Out), so the trap here is confusing an EPG or VMM domain as the solution for Layer 3 external routing when they serve entirely different purposes within the ACI architecture.

How to eliminate wrong answers

Option A is wrong because a VMM domain integrates ACI with hypervisor managers (e.g., VMware vCenter) for virtual machine networking, not for external Layer 3 connectivity. Option B is wrong because an EPG (Endpoint Group) is a logical grouping of endpoints within a tenant, used for intra-fabric policy enforcement, not for routing to external networks. Option D is wrong because a VXLAN tunnel is the underlying encapsulation used for overlay traffic within the ACI fabric; external Layer 3 connectivity requires routed interfaces and routing protocols, not a VXLAN tunnel.

Practice this question →

MCQhard

An engineer is configuring BGP EVPN for VXLAN in a spine-leaf fabric. The leaf switches must advertise host IP-to-MAC mappings to the control plane. Which BGP address family should be enabled on the leaf switches?

A.address-family vpnv4 unicast

B.address-family ipv4 unicast

C.address-family link-state

D.address-family l2vpn evpn

AnswerD

The `address-family l2vpn evpn` enables BGP to carry Network Layer Reachability Information (NLRI) for MAC/IP advertisement routes, which directly satisfies the requirement for leaf switches to advertise host IP-to-MAC mappings in a VXLAN EVPN fabric. This address family uses Route Type 2 (MAC/IP Advertisement) to encode both the MAC address and the associated host IP, allowing the control plane to distribute these bindings without flooding data-plane traffic.

Why this answer

In a VXLAN BGP EVPN fabric, leaf switches must advertise host IP-to-MAC mappings using the BGP EVPN address family. This is enabled with the command 'address-family l2vpn evpn' under the BGP configuration, which carries Type-2 routes (MAC/IP advertisement routes) that contain both the MAC address and the associated IP address of the host.

Exam trap

Cisco often tests the distinction between 'address-family l2vpn evpn' and 'address-family vpnv4 unicast' to trap candidates who confuse EVPN with traditional MPLS L3VPN or who assume that any VPN-related address family works for VXLAN.

How to eliminate wrong answers

Option A is wrong because 'address-family vpnv4 unicast' is used for MPLS Layer 3 VPNs to carry IPv4 routes with VPN labels, not for VXLAN EVPN host IP-to-MAC mappings. Option B is wrong because 'address-family ipv4 unicast' carries standard IPv4 unicast routes and does not support the advertisement of MAC addresses or EVPN NLRI. Option C is wrong because 'address-family link-state' is used for OSPF or IS-IS link-state information distribution, typically in segment routing or traffic engineering contexts, and has no role in VXLAN EVPN control plane operations.

Practice this question →

Multi-Selectmedium

Which TWO statements are true about VPC consistency checks? (Choose two.)

Select 2 answers

A.All configuration parameters must match exactly on both peers.

B.Consistency check is optional and disabled by default.

C.The 'show vpc consistency-parameters' command displays the status.

D.Consistency check is performed only when the peer-link comes up.

E.Inconsistency can cause the VPC member port to be suspended.

AnswersC, E

This command shows which parameters are consistent.

Why this answer

The 'show vpc consistency-parameters' command is the primary tool used to verify that the VPC peer switches have matching configurations for critical parameters. This command displays the status of each consistency check parameter, allowing an administrator to identify mismatches that could disrupt VPC operation.

Exam trap

Cisco often tests the misconception that all parameters must match (A) or that checks are only at peer-link bring-up (D), when in reality only type-1 parameters are enforced and checks are continuous.

Practice this question →

MCQeasy

A network engineer is implementing QoS on a Nexus 9000 switch. The requirement is to prioritize storage traffic (iSCSI) and ensure lossless behavior. Which queuing strategy should be applied to the egress interface?

A.Tail drop with DSCP-based classification.

B.Weighted Round Robin (WRR) with three queues.

C.Priority Flow Control (PFC) with a no-drop queue for iSCSI.

D.Policing at the ingress and marking at the egress.

AnswerC

PFC enables lossless Ethernet by pausing traffic when buffers are full.

Why this answer

Priority Flow Control (PFC) is the IEEE 802.1Qbb mechanism designed to provide lossless behavior for specific traffic classes, such as iSCSI storage traffic, on Nexus 9000 switches. By creating a no-drop queue for iSCSI, PFC uses pause frames on a per-priority basis to prevent buffer overflow, ensuring zero packet loss required by storage protocols.

Exam trap

Cisco often tests the misconception that any queuing or scheduling algorithm (like WRR or tail drop) can provide lossless behavior, but the trap here is that only PFC with a dedicated no-drop queue satisfies the strict no-loss requirement for storage traffic like iSCSI or FCoE.

How to eliminate wrong answers

Option A is wrong because tail drop is a simple congestion avoidance mechanism that drops packets indiscriminately when a queue is full, which cannot guarantee lossless behavior for iSCSI; DSCP-based classification alone does not prevent drops. Option B is wrong because Weighted Round Robin (WRR) is a scheduling algorithm that services multiple queues based on weights, but it does not provide per-priority pause or lossless guarantees; iSCSI requires a no-drop queue, not just weighted servicing. Option D is wrong because policing at the ingress drops excess traffic to enforce a rate limit, which contradicts the requirement for lossless behavior; marking at the egress only sets QoS markings and does not prevent drops.

Practice this question →

MCQeasy

A data center runs OSPF as the underlay for an EVPN-VXLAN fabric. The fabric includes two spine switches and eight leaf switches. After adding a new leaf switch, the network team notices that some EVPN routes are missing from the other leaves. The new leaf has established BGP EVPN sessions to both spines and the BGP sessions are up. The spines report receiving all routes from the new leaf, but the other leaves do not receive certain prefixes. The engineer checks the BGP configuration on the new leaf and sees the address-family l2vpn evpn is configured under router bgp. Which action should the engineer take to resolve the issue?

A.Check the new leaf's BGP router ID for uniqueness

B.Verify the new leaf has the address-family l2vpn evpn activated under the neighbor configuration

C.Ensure the new leaf's BGP next-hop-self is enabled

D.Verify the cluster ID on the route reflectors is consistent

AnswerB

The address-family must be activated under each neighbor to advertise routes.

Why this answer

The issue is that the new leaf has BGP EVPN sessions to both spines, but other leaves do not receive certain prefixes. Since the spines (acting as route reflectors) receive all routes from the new leaf but do not propagate them to other leaves, the most likely cause is that the address-family l2vpn evpn is not activated under the neighbor configuration on the new leaf. Without this activation, the new leaf does not advertise its EVPN routes to the spines, even though the BGP session is up and the address-family is configured globally under router bgp.

Exam trap

Cisco often tests the distinction between configuring the address-family globally under router bgp versus activating it under a specific neighbor, leading candidates to assume global configuration is sufficient.

How to eliminate wrong answers

Option A is wrong because a duplicate BGP router ID would cause session flapping or instability, not a selective missing of certain prefixes while the BGP sessions remain up. Option C is wrong because next-hop-self is not required in an EVPN-VXLAN fabric with an OSPF underlay; the spines (route reflectors) typically handle next-hop processing, and the issue is about route advertisement, not next-hop reachability. Option D is wrong because the cluster ID on route reflectors must be consistent to prevent loops, but inconsistent cluster IDs would cause all reflected routes to be affected, not just certain prefixes, and the spines are already receiving all routes from the new leaf.

Practice this question →

Multi-Selectmedium

Which three EVPN route types are essential for VXLAN EVPN operation in a typical data center fabric? (Choose three.)

Select 3 answers

A.Type-3 (Inclusive Multicast Ethernet Tag)

B.Type-2 (MAC/IP Advertisement)

C.Type-4 (Ethernet Segment)

D.Type-5 (IP Prefix Advertisement)

E.Type-1 (Ethernet Auto-Discovery)

AnswersA, B, D

Required for BUM traffic forwarding.

Why this answer

Type-3 (Inclusive Multicast Ethernet Tag) routes are essential for VXLAN EVPN because they enable BUM traffic replication across the underlay network by advertising the VNI and multicast group mapping, allowing VTEPs to join the correct multicast tree for flooding unknown unicast, broadcast, and multicast frames.

Exam trap

Cisco often tests the misconception that Type-1 and Type-4 are required for all VXLAN EVPN deployments, but they are only mandatory for multi-homing (EVPN-MH) or MPLS interworking, not for a typical single-homed data center fabric.

Practice this question →

MCQmedium

An engineer is configuring MST on a pair of Cisco Nexus switches that will be part of a vPC domain. The vPC peer-link will carry multiple MST instances. Which MST parameter must be identical on both vPC peers to ensure proper operation?

A.PortFast and BPDUguard settings

B.STP root bridge priority

C.MST region configuration (name, revision, mapping)

D.STP path cost for instance 0

AnswerC

These must match for switches to belong to the same MST region.

Why this answer

In a vPC domain with MST, both peers must share an identical MST region configuration (name, revision number, and VLAN-to-instance mapping) to ensure they agree on which VLANs belong to which MST instance. Without matching region configurations, the switches would treat each other as being in different MST regions, breaking the common spanning tree topology required for the vPC peer-link to properly carry multiple MST instances.

Exam trap

The trap here is that candidates often confuse MST region configuration with other STP parameters like root priority or path cost, assuming any STP-related value must match on both vPC peers, but only the region identity (name, revision, mapping) is critical for MST to function correctly across the peer-link.

How to eliminate wrong answers

Option A is wrong because PortFast and BPDUguard are per-port edge features that speed up convergence and protect against loops, but they are not required to be identical on vPC peers for MST operation. Option B is wrong because STP root bridge priority can differ between vPC peers; the vPC system acts as a single logical STP entity, and the root bridge priority is typically set on the primary vPC switch, not required to match on both. Option D is wrong because STP path cost for instance 0 (IST) is a per-interface parameter that can be tuned independently on each switch and does not need to be identical across vPC peers to ensure proper MST operation.

Practice this question →

MCQeasy

Which VLAN range is reserved by default on Cisco Nexus switches?

A.VLAN 1

B.VLAN 1002-1005

C.VLAN 3968-4047

D.VLAN 4094

AnswerA

VLAN 1 is the default and cannot be removed.

Why this answer

VLAN 1 is the default VLAN on Cisco Nexus switches and cannot be deleted or renamed. It is automatically created on all switches and carries all untagged traffic by default, making it a reserved VLAN that is always present in the VLAN database.

Exam trap

Cisco often tests the misconception that VLANs 1002-1005 are reserved on all platforms, but on Nexus switches these legacy VLANs are not present, and the trap is that candidates confuse classic IOS behavior with NX-OS behavior.

How to eliminate wrong answers

Option B is wrong because VLANs 1002-1005 are reserved for legacy Token Ring and FDDI networks on classic Cisco IOS switches, but on Nexus switches these VLANs are not reserved by default and are not present in the VLAN database. Option C is wrong because VLANs 3968-4047 are reserved for internal use by the switch (e.g., for multicast, Layer 3 interfaces, or system VLANs) and are not user-configurable, but they are not the default reserved VLAN range. Option D is wrong because VLAN 4094 is the extended VLAN ID used for the default VLAN on some platforms or for the native VLAN on trunk ports, but it is not the default reserved VLAN on Nexus switches; VLAN 1 holds that role.

Practice this question →

MCQmedium

Which NX-OS feature ensures that vPC member ports on both peers are configured identically to prevent inconsistencies that could lead to traffic black-holing?

A.vPC peer-link

B.vPC consistency check

C.vPC peer-keepalive

D.vPC auto-recovery

AnswerB

Consistency checks ensure parameter matching between peers.

Why this answer

The vPC consistency check ensures that critical parameters (e.g., VLAN configuration, STP settings, interface properties) are identical on both vPC peer switches. If a mismatch is detected, the vPC member port is suspended to prevent traffic black-holing caused by asymmetric forwarding. This mechanism is enforced by the Cisco NX-OS vPC Type-1 and Type-2 consistency checks.

Exam trap

Cisco often tests the distinction between the vPC peer-link (data/control plane) and the vPC peer-keepalive (heartbeat), leading candidates to mistakenly associate the keepalive with configuration synchronization.

How to eliminate wrong answers

Option A is wrong because the vPC peer-link is the inter-switch link used for control-plane communication and data traffic between peers, not a mechanism to enforce identical configurations. Option C is wrong because the vPC peer-keepalive is a Layer 3 heartbeat link that detects peer failures, not a configuration validation tool. Option D is wrong because vPC auto-recovery is a feature that allows a vPC peer to resume forwarding after a peer-link failure, not a consistency verification mechanism.

Practice this question →

MCQmedium

A data center uses Cisco ACI with multiple tenants. The security policy requires that all traffic between EPGs must be explicitly allowed via contracts. However, the operations team reports that communication between two EPGs in the same bridge domain is working even though no contract is applied. What is the most likely reason?

A.The default behavior in ACI allows communication between EPGs in the same bridge domain without a contract

B.The contract is applied but not enforced due to a configuration error

C.The VRF has a default route that bypasses contract enforcement

D.A preferred group contract is applied to the VRF

AnswerA

ACI allows intra-BD communication by default; contracts are needed for inter-BD or inter-VRF traffic.

Why this answer

In Cisco ACI, the default behavior for EPGs within the same bridge domain (BD) is that they can communicate without a contract. This is because EPGs in the same BD share the same Layer 2 domain, and ACI does not enforce contract-based filtering for intra-BD traffic unless a contract is explicitly applied. The security policy requiring contracts applies only to inter-BD or inter-VRF traffic, not to intra-BD communication.

Exam trap

Cisco often tests the misconception that contracts are required for all EPG-to-EPG communication, but the trap here is that intra-BD traffic is an exception where no contract is needed by default.

How to eliminate wrong answers

Option B is wrong because if a contract were applied but not enforced due to a configuration error, the traffic would still be blocked or behave unpredictably, not consistently work; ACI enforces contracts at the leaf switch level, and a misconfiguration would typically cause a deny, not an allow. Option C is wrong because a default route in the VRF does not bypass contract enforcement; contracts are enforced at the EPG level regardless of routing, and a default route only affects Layer 3 forwarding, not policy enforcement. Option D is wrong because a preferred group contract would explicitly allow all traffic within the VRF, but the question states no contract is applied; a preferred group contract is a contract that must be explicitly configured, and its absence means it cannot be the reason.

Practice this question →

MCQmedium

A network engineer is configuring a Fabric Extender (FEX) to connect to a parent switch. Which best practice should be followed for FEX host interfaces?

A.Configure all host interfaces as trunk ports.

B.Use the same FEX ID for redundancy.

C.Use LACP for the FEX uplinks.

D.Enable Virtual Port Channel (vPC) on the parent switch.

E.Disable spanning-tree on FEX host interfaces.

AnswerD

vPC provides active-active redundancy for FEX uplinks.

Why this answer

Enabling Virtual Port Channel (vPC) on the parent switch is a best practice for FEX host interfaces because it allows the FEX to be dual-homed to two separate parent switches, providing link-level redundancy and active-active forwarding. Without vPC, the FEX would rely on a single parent switch, creating a single point of failure and potentially causing traffic black-holing during a parent switch failure.

Exam trap

Cisco often tests the misconception that FEX uplinks require LACP or that FEX IDs can be shared for redundancy, when in fact FEX uplinks use static fabric channels and each FEX must have a unique ID.

How to eliminate wrong answers

Option A is wrong because configuring all host interfaces as trunk ports is not a best practice; FEX host interfaces should typically be configured as access ports or host-facing ports (using the 'switchport host' macro) to optimize STP and port-channel settings, and trunk ports are only needed if the downstream device requires multiple VLANs. Option B is wrong because using the same FEX ID for redundancy is not possible; each FEX must have a unique FEX ID to be properly identified by the parent switch, and redundancy is achieved through vPC or dual-homing, not by sharing IDs. Option C is wrong because LACP is not used for FEX uplinks; FEX uplinks use a proprietary fabric channel (FabricPortChannel) that does not support LACP, and the FEX-to-parent switch link is a static port-channel or individual fabric links.

Option E is wrong because disabling spanning-tree on FEX host interfaces is dangerous and not a best practice; while FEX host interfaces can use the 'spanning-tree portfast' feature to bypass listening/learning states, completely disabling spanning-tree would risk loops if a downstream device is misconfigured or a cable is looped.

Practice this question →

MCQmedium

A server connected to Ethernet1/1 is unable to communicate on VLAN 1. The server is configured to send untagged frames. Based on the exhibit, what is the most likely cause?

A.The spanning-tree port type edge trunk is causing BPDU guard to block the port.

B.The port is in err-disabled state due to a loop.

C.VLAN 1 is not allowed on the trunk, so untagged frames are dropped.

D.The port is administratively down.

AnswerC

Untagged frames are placed in native VLAN 1, but VLAN 1 is not in the allowed list.

Why this answer

The server sends untagged frames, which are placed into the native VLAN of the trunk port. By default, the native VLAN is VLAN 1. However, if VLAN 1 is explicitly removed from the allowed VLAN list on the trunk (e.g., with 'switchport trunk allowed vlan remove 1'), the switch will drop all frames belonging to that VLAN, including untagged frames that would otherwise be classified into VLAN 1.

This matches the exhibit where the port is configured as a trunk but VLAN 1 is not allowed, causing the server's traffic to be dropped.

Exam trap

Cisco often tests the misconception that untagged frames are always allowed on a trunk port, but the trap here is that the native VLAN must be explicitly permitted in the allowed VLAN list; otherwise, untagged frames are dropped even if the port is up and configured as a trunk.

How to eliminate wrong answers

Option A is wrong because spanning-tree port type edge trunk enables PortFast and BPDU guard on a trunk, but BPDU guard would only block the port if a BPDU is received, not because of VLAN 1 untagged traffic. Option B is wrong because the port is not in err-disabled state; the exhibit shows the port is up/up, and a loop would cause a different error condition like a spanning-tree loop or err-disable due to a loop guard violation. Option D is wrong because the port is administratively up; the exhibit shows the port status as 'connected' or 'up/up', not 'administratively down'.

Practice this question →

MCQeasy

A data center network uses VXLAN EVPN for network virtualization. Which component is responsible for advertising MAC addresses and host routes across the fabric?

A.Static routing.

B.MP-BGP EVPN address family.

C.OSPF.

D.VXLAN VTEP.

AnswerB

MP-BGP EVPN is the control plane for VXLAN EVPN.

Why this answer

In a VXLAN EVPN fabric, the MP-BGP EVPN address family (AFI L2VPN / SAFI EVPN) is the control plane protocol that distributes MAC addresses, IP-to-MAC bindings, and host routes (Type-2 routes) across all VTEPs. This enables each VTEP to build its forwarding table dynamically without relying on data-plane learning or flooding, ensuring optimal east-west traffic forwarding.

Exam trap

Cisco often tests the distinction between the data-plane function (VTEP encapsulation) and the control-plane function (MP-BGP EVPN), so the trap here is that candidates mistakenly think the VTEP itself advertises MAC addresses, when in fact it relies on MP-BGP EVPN for that role.

How to eliminate wrong answers

Option A is wrong because static routing is a manual configuration method that cannot dynamically advertise MAC addresses or host routes across a VXLAN EVPN fabric; it lacks the control-plane intelligence needed for EVPN route distribution. Option C is wrong because OSPF is an interior gateway protocol (IGP) designed for IPv4/IPv6 unicast routing, not for advertising Layer 2 MAC addresses or EVPN-specific routes like Type-2 or Type-3. Option D is wrong because a VXLAN VTEP is a data-plane endpoint that encapsulates/decapsulates VXLAN frames; it does not itself advertise MAC addresses or host routes—that function is performed by the control plane (MP-BGP EVPN).

Practice this question →

Multi-Selectmedium

A network engineer is configuring 802.1Q trunking between a Nexus switch and a server. Which TWO statements are true regarding 802.1Q trunking?

Select 2 answers

A.The native VLAN is tagged by default

B.The VLAN ID is 12 bits long

C.A 4-byte tag is inserted into the Ethernet frame

D.Trunks can only carry one VLAN

E.The frame check sequence (FCS) is recalculated after tagging

AnswersB, E

Correct — the VLAN ID field is 12 bits long.

Why this answer

802.1Q trunking uses a 4-byte tag to carry VLAN information, but the native VLAN is sent untagged, so not all frames receive the tag. The VLAN ID field is 12 bits (B), and after tagging, the FCS must be recalculated (E). Option A is false because the native VLAN is untagged.

Option C is false because only non-native VLAN frames are tagged. Option D is false because trunks can carry multiple VLANs.

Exam trap

Candidates often assume every frame on a trunk gets a 4-byte tag, but the native VLAN is always untagged. The question asks for two true statements; B and E are correct, and C is a common trap.

Practice this question →

MCQeasy

Which command displays the VLANs allowed on a trunk interface?

A.show running-config interface

B.show vlan

C.show interface switchport

D.show interface trunk

AnswerD

This command directly shows trunk status and allowed VLANs.

Why this answer

The 'show interface trunk' command displays trunk parameters, including the VLANs allowed on the trunk interface. This command shows the trunking mode, encapsulation (e.g., 802.1Q), and the allowed VLAN list for each trunk port. It is the direct command to verify which VLANs are permitted on a specific trunk link.

Exam trap

The trap here is that candidates often confuse 'show interface switchport' (which shows trunking status and native VLAN) with 'show interface trunk' (which shows the allowed VLAN list), leading them to choose option C instead of D.

How to eliminate wrong answers

Option A is wrong because 'show running-config interface' displays the running configuration for an interface, which may include the 'switchport trunk allowed vlan' command if configured, but it does not show the dynamic or negotiated allowed VLAN list, and it is not the standard command to view active trunk parameters. Option B is wrong because 'show vlan' displays VLAN information and which ports are members of each VLAN, but it does not show the allowed VLAN list on a trunk interface; it shows access VLAN membership. Option C is wrong because 'show interface switchport' displays administrative and operational switchport modes, including trunking status, but it does not show the allowed VLAN list; it shows the native VLAN and trunk encapsulation but not the permitted VLANs.

Practice this question →

MCQeasy

In a Cisco ACI fabric, which component is responsible for policy enforcement and management of the entire infrastructure?

A.Leaf switch

B.DCNM

C.APIC controller

D.Spine switch

AnswerC

The APIC is the central policy and management controller in ACI.

Why this answer

The APIC (Application Policy Infrastructure Controller) is the central policy and management entity in Cisco ACI. It enforces the application-centric policy model, manages the fabric's operational state, and provides the single point of configuration and monitoring for the entire ACI fabric. Without the APIC, the leaf and spine switches operate as standalone devices with no centralized policy enforcement.

Exam trap

Cisco often tests the misconception that leaf switches perform policy enforcement independently, but in ACI, leaf switches are policy-enforcement points that receive all policy definitions from the APIC, not autonomous decision-makers.

How to eliminate wrong answers

Option A is wrong because leaf switches are data-plane devices that forward traffic and enforce policies received from the APIC, but they do not manage or originate policies for the entire infrastructure. Option B is wrong because DCNM (Data Center Network Manager) is a legacy management tool for traditional NX-OS environments and is not used for ACI fabric policy management; ACI uses the APIC exclusively for policy and management. Option D is wrong because spine switches provide high-speed interconnectivity between leaf switches and handle fabric forwarding (e.g., using IS-IS for underlay routing), but they have no role in policy enforcement or centralized management.

Practice this question →

MCQhard

In ACI, when integrating with VMware vSphere, which component is used to automatically push port group configurations to virtual switches?

A.APIC

B.VMM domain

C.Tenant

D.L3Out

AnswerB

VMM domain handles integration with hypervisors.

Why this answer

The VMM (Virtual Machine Manager) domain in ACI is the integration point with VMware vSphere. It automatically pushes port group configurations to virtual switches by leveraging the VMware vCenter API, ensuring that ACI network policies are consistently applied to the hypervisor's virtual switches without manual intervention.

Exam trap

Cisco often tests the misconception that APIC directly pushes configurations to vSphere, but the VMM domain is the actual integration component that abstracts and automates the port group push via vCenter APIs.

How to eliminate wrong answers

Option A is wrong because APIC is the centralized controller for ACI policy management, not the component that directly pushes port group configurations to virtual switches; the VMM domain handles that integration. Option C is wrong because a Tenant is a logical container for policies (e.g., EPGs, contracts) and does not directly interact with vSphere to push port group configurations. Option D is wrong because L3Out is used for external Layer 3 connectivity (e.g., routing to outside networks) and has no role in VMware vSphere integration or port group automation.

Practice this question →

Multi-Selectmedium

Which two statements correctly describe VXLAN BUM traffic handling? (Choose two.)

Select 2 answers

A.Ingress replication sends unicast copies of the BUM traffic to each remote VTEP.

B.BUM traffic is dropped by default.

C.Multicast group is used to distribute BUM traffic to all VTEPs that need it.

D.Ingress replication sends a single multicast packet to all VTEPs.

E.Multicast is required for VXLAN BUM handling.

AnswersA, C

Correct description.

Why this answer

In VXLAN, BUM traffic (Broadcast, Unknown unicast, Multicast) can be handled using ingress replication, where the ingress VTEP creates multiple unicast copies of the packet and sends them directly to each remote VTEP. This is the default mode in many VXLAN implementations, especially in EVPN-based fabrics, and does not require a multicast group in the underlay. Option A correctly describes this behavior.

Exam trap

Cisco often tests the misconception that multicast is mandatory for VXLAN BUM handling, but the exam expects you to know that ingress replication is a valid and commonly used alternative, especially in EVPN-based designs.

Practice this question →

MCQeasy

A data center uses VPC between two Nexus switches. Which statement is true about the VPC peer-link?

A.It must be a single link.

B.It carries only control traffic.

C.It is used only for orphan ports.

D.It carries both data and control traffic.

AnswerD

The VPC peer-link is used for both control plane communication (e.g., configuration synchronization) and data plane forwarding (e.g., for orphan ports or traffic requiring cross-peer forwarding).

Why this answer

The VPC peer-link is a critical component in a vPC domain, carrying both data traffic (e.g., traffic from orphan ports or traffic that must traverse the peer-link for forwarding) and control traffic (e.g., vPC keepalive messages and Cisco Fabric Services (CFS) synchronization). This dual role ensures that the two Nexus switches operate as a single logical entity for the downstream devices, providing loop-free Layer 2 multipathing.

Exam trap

Cisco often tests the misconception that the peer-link is only for control traffic, but the trap here is that candidates forget the peer-link also carries data traffic for orphan ports and for forwarding when a vPC member link fails.

How to eliminate wrong answers

Option A is wrong because the peer-link can consist of up to eight physical links bundled into a single port-channel (using LACP or static on), not a single link. Option B is wrong because the peer-link carries both control traffic (e.g., vPC keepalive, CFS) and data traffic (e.g., traffic for orphan ports, multicast, or broadcast frames). Option C is wrong because the peer-link is used for many purposes beyond orphan ports, including forwarding traffic for vPC member ports when the local link fails and synchronizing MAC address tables.

Practice this question →

Multi-Selecteasy

Which TWO commands are used on NX-OS to verify vPC status and consistency? (Choose two.)

Select 2 answers

A.show vpc consistency-parameters

B.show port-channel summary

C.show vpc

D.show running-config vpc

E.show vpc role

AnswersA, C

Displays consistency parameters for vPC member ports.

Why this answer

The 'show vpc' command displays the overall vPC status, including peer link and keepalive status, while 'show vpc consistency-parameters' verifies that both peers have matching configurations (e.g., STP, VLAN, MTU) to prevent traffic disruption. These two commands are essential for validating vPC operational health and configuration consistency.

Exam trap

Cisco often tests the distinction between commands that show configuration versus those that show operational status and consistency, leading candidates to mistakenly choose 'show running-config vpc' or 'show vpc role' instead of the correct verification commands.

Practice this question →

MCQeasy

In a spine-leaf architecture, what is the primary advantage of having multiple spine switches?

A.Redundancy and load balancing

B.Lower latency

C.Simplified management

D.Increased oversubscription

AnswerA

Spines provide multiple paths for redundancy and ECMP.

Why this answer

In a spine-leaf architecture, multiple spine switches provide redundancy by ensuring that if one spine fails, traffic can still flow through other spines. They also enable load balancing because leaf switches can use equal-cost multipath (ECMP) routing to distribute traffic across all available spine uplinks, maximizing bandwidth utilization and preventing congestion on any single path.

Exam trap

Cisco often tests the misconception that multiple spines primarily reduce latency, but the real advantage is redundancy and load balancing through ECMP, not a reduction in per-hop forwarding delay.

How to eliminate wrong answers

Option B is wrong because lower latency is primarily achieved by the single-hop nature of spine-leaf (every leaf is one hop from any spine), not by having multiple spines; adding more spines does not reduce per-hop latency. Option C is wrong because multiple spine switches increase management complexity (more devices to configure, monitor, and troubleshoot), not simplify it. Option D is wrong because increased oversubscription would be a disadvantage, not an advantage; multiple spines actually reduce oversubscription by providing more uplink bandwidth between leaf and spine layers.

Practice this question →

MCQmedium

In the context of ACI L3Out, which object is used to advertise external networks into the ACI fabric and is associated with a VRF?

A.Bridge Domain

B.L3Out

C.Contract

D.External EPG

AnswerB

L3Out defines the external connectivity and routing protocol.

Why this answer

In ACI, an L3Out is the logical construct that provides connectivity from the ACI fabric to external Layer 3 networks. It is associated with a VRF to define the routing context, and it is the object under which external networks are advertised into the fabric via route redistribution or static routes. The L3Out contains the external EPGs and the protocol profiles (e.g., OSPF, BGP, EIGRP) that control the advertisement.

Exam trap

Cisco often tests the misconception that an External EPG is the object associated with the VRF for route advertisement, but in reality, the L3Out is the parent object that holds the VRF association and controls the routing protocols.

How to eliminate wrong answers

Option A is wrong because a Bridge Domain is a Layer 2 forwarding construct within a VRF that defines a subnet and flooding scope; it does not advertise external networks into the fabric. Option C is wrong because a Contract is a policy object that defines allowed traffic flows between EPGs, not a routing construct for external network advertisement. Option D is wrong because an External EPG is a child object of an L3Out that represents external subnets or IP prefixes, but it is the L3Out itself that is associated with the VRF and is the primary object used to advertise those networks into the fabric.

Practice this question →

MCQmedium

A network engineer is configuring OSPF on a Nexus switch. To ensure fast convergence in case of a link failure, which OSPF feature should be enabled?

A.OSPF authentication

B.OSPF Fast Hello

C.OSPF stub area

D.OSPF route summarization

AnswerB

Fast Hello allows sub-second hello intervals for faster failure detection.

Why this answer

OSPF Fast Hello (B) is the correct feature to enable for fast convergence on a Nexus switch because it reduces the dead interval to less than one second by sending Hello packets at sub-second intervals (e.g., every 333 ms for a 1-second dead interval). This allows OSPF neighbors to detect a link failure much faster than the default 40-second dead interval on broadcast networks, triggering quicker SPF recalculation and route convergence.

Exam trap

Cisco often tests the distinction between features that improve convergence speed (like Fast Hello or BFD) versus features that improve scalability or security (like stub areas, summarization, or authentication), leading candidates to mistakenly choose options that optimize the OSPF database rather than accelerate failure detection.

How to eliminate wrong answers

Option A is wrong because OSPF authentication (MD5 or SHA) provides security by verifying neighbor identity and preventing route injection, but it does not affect convergence speed or failure detection. Option C is wrong because an OSPF stub area reduces the size of the LSDB by blocking Type 5 LSAs and using a default route, which improves scalability and memory usage but does not accelerate failure detection or convergence. Option D is wrong because OSPF route summarization (via area-range commands) reduces routing table size and limits LSA flooding across areas, but it does not directly reduce the time to detect a link failure or trigger SPF recalculation.

Practice this question →

Multi-Selectmedium

Which TWO statements are true regarding VXLAN BUM traffic handling? (Choose two.)

Select 2 answers

A.Ingress replication requires the ingress VTEP to maintain a list of remote VTEPs.

B.Multicast-based replication requires a multicast routing protocol like PIM in the underlay.

C.Ingress replication scales better than multicast in large fabrics.

D.Multicast-based replication uses IGMP snooping to build replication lists.

E.Ingress replication is only supported with OSPF underlay.

AnswersA, B

The ingress VTEP replicates to all known remote VTEPs for the VNI.

Why this answer

In ingress replication, the ingress VTEP must know all remote VTEPs in the VXLAN segment to unicast-encapsulate and send BUM traffic to each one individually. This list is typically learned via the control plane (e.g., BGP EVPN) or statically configured. Without this list, the ingress VTEP cannot replicate BUM frames to the correct remote destinations.

Exam trap

Cisco often tests the misconception that ingress replication scales better than multicast, but the trap is that ingress replication actually consumes more bandwidth and CPU on the ingress VTEP, making it less scalable in large fabrics compared to multicast-based replication.

Practice this question →

MCQhard

In a Cisco ACI fabric, a tenant has multiple bridge domains in the same VRF all with 'Unicast Routing' enabled and hardware proxy mode. However, endpoints in different BDs within the same VRF cannot communicate even with a contract. What is a possible reason?

A.The 'L3 Unknown Multicast Flooding' is set to flood.

B.The 'ARP Flooding' is enabled.

C.The contracts are unidirectional.

D.The bridge domains are in different subnets.

AnswerB

In hardware proxy mode, ARP flooding should be disabled to enable proxy ARP. If enabled, the leaf will flood ARP requests and proxy behavior may not function, potentially breaking communication.

Why this answer

When 'Unicast Routing' is enabled on a bridge domain (BD) in hardware proxy mode, the ACI fabric relies on hardware proxy for forwarding. In this mode, ARP flooding should be disabled to prevent excessive flooding and allow the fabric to properly resolve ARP via the COOP database. If 'ARP Flooding' is enabled, the fabric floods ARP requests across all BDs, which can cause ARP resolution to fail for endpoints in different BDs because the hardware proxy expects ARP to be handled differently.

This prevents inter-BD communication even with a contract in place. Therefore, having 'ARP Flooding' enabled is a possible reason for the communication failure.

Exam trap

A common misconception is that 'ARP Flooding' must be enabled to allow endpoint discovery, but in hardware proxy mode with Unicast Routing enabled, ARP Flooding should be disabled to allow the spine proxy to handle ARP resolution for inter-BD communication.

How to eliminate wrong answers

Option A is wrong because 'L3 Unknown Multicast Flooding' set to flood controls how unknown multicast traffic is handled at Layer 3, not ARP or unicast routing between BDs; it does not affect inter-BD unicast communication. Option C is wrong because contracts in ACI are inherently unidirectional by design (a contract provides a direction from provider to consumer), but this does not prevent communication; a contract must be applied correctly with both directions considered, but the issue here is ARP resolution, not contract directionality. Option D is wrong because bridge domains in different subnets are expected for inter-BD routing; the problem is not subnet mismatch but the lack of ARP flooding to resolve endpoints across BDs.

Practice this question →

MCQeasy

In a Cisco ACI fabric, which component acts as the centralized policy and management controller?

A.Spine switch

B.APIC

C.DCNM

D.Leaf switch

AnswerB

APIC is the centralized policy controller in ACI.

Why this answer

The APIC (Application Policy Infrastructure Controller) is the centralized policy and management controller in a Cisco ACI fabric. It serves as the single point of configuration, policy definition, and monitoring for the entire fabric, managing all leaf and spine switches through a declarative model. The APIC does not handle data-plane forwarding but orchestrates the application of policies via the OpFlex protocol and the ACI object model.

Exam trap

Cisco often tests the misconception that the spine switch is the central controller because it is the top-level device in the fabric topology, but in reality, the spine is a pure data-plane element with no policy or management role.

How to eliminate wrong answers

Option A is wrong because spine switches in ACI are pure forwarding elements that provide high-speed connectivity between leaf switches and handle east-west traffic; they do not run any centralized policy or management functions. Option C is wrong because DCNM (Data Center Network Manager) is a legacy management tool for traditional NX-OS environments and is not used in ACI; the APIC replaces DCNM for ACI fabric management. Option D is wrong because leaf switches are edge devices that connect servers and enforce policies locally based on instructions from the APIC, but they do not act as the centralized controller.

Practice this question →

MCQeasy

In a VXLAN EVPN fabric, which protocol is used to exchange MAC and IP address reachability information among VTEPs?

A.BGP

B.IS-IS

C.EIGRP

D.OSPF

AnswerA

BGP EVPN is the standard control plane for VXLAN.

Why this answer

In a VXLAN EVPN fabric, BGP (Border Gateway Protocol) is used as the control plane protocol to exchange MAC and IP address reachability information among VTEPs. Specifically, MP-BGP (Multiprotocol BGP) with EVPN address family (AFI L2VPN / SAFI EVPN) carries Type-2 routes (MAC/IP advertisement) to distribute host reachability across the overlay network, enabling efficient MAC learning and ARP suppression.

Exam trap

Cisco often tests the distinction between underlay routing protocols (OSPF, IS-IS, EIGRP) and the overlay control plane (MP-BGP EVPN), leading candidates to mistakenly select an IGP that handles only underlay IP reachability rather than the protocol that actually exchanges MAC/IP information in the overlay.

How to eliminate wrong answers

Option B (IS-IS) is wrong because IS-IS is a link-state IGP used for underlay routing (e.g., IP reachability between VTEPs) but does not carry MAC/IP reachability information in the overlay; EVPN requires MP-BGP for this purpose. Option C (EIGRP) is wrong because EIGRP is a Cisco-proprietary distance-vector IGP that operates only in the underlay and lacks the multiprotocol extensions and EVPN address family needed to exchange MAC/IP routes. Option D (OSPF) is wrong because OSPF is a link-state IGP used for underlay IP routing and cannot transport Layer 2 MAC or host IP information; it does not support the EVPN NLRI or BGP-based control plane required for VXLAN EVPN fabrics.

Practice this question →

Multi-Selecteasy

An engineer is troubleshooting a VXLAN network where traffic between two VTEPs in the same VNI is not being forwarded. The underlay network is operational and IP connectivity exists between the VTEPs. Which two actions should the engineer take to verify the VXLAN configuration?

Select 2 answers

A.Verify that the multicast group for BUM traffic is reachable.

B.Verify that the NVE interface is configured with the correct source-interface.

C.Verify that the VXLAN tunnel endpoint IP addresses are in the same subnet.

D.Verify that the VNI is mapped to the correct VLAN on the local VTEP.

E.Verify that the VXLAN routing table is populated correctly.

AnswersB, D

The NVE interface must have a valid source-interface to encapsulate VXLAN packets.

Why this answer

The NVE interface's source-interface (typically a loopback) defines the local VTEP IP address used for VXLAN encapsulation. If this source-interface is misconfigured or not reachable from the remote VTEP, VXLAN packets will not be sourced from the correct IP, breaking traffic forwarding even when underlay IP connectivity exists.

Exam trap

Cisco often tests the misconception that VXLAN requires multicast or that VTEPs must be in the same subnet, but in reality VXLAN operates over a routed underlay and can use unicast or EVPN for BUM traffic.

Practice this question →

MCQmedium

In a spine-leaf architecture, the oversubscription ratio between leaf switches and spine switches is 3:1. Each leaf has 48 x 10G server ports and 4 x 40G uplinks to the spine. What is the oversubscription ratio at the leaf level?

A.1:1

B.4:1

C.2:1

D.3:1

AnswerD

480/160 = 3:1.

Why this answer

The oversubscription ratio at the leaf level is calculated by comparing the total bandwidth of the server-facing ports to the total bandwidth of the uplink ports. Each leaf has 48 x 10G server ports (480 Gbps) and 4 x 40G uplinks (160 Gbps). The ratio is 480:160, which simplifies to 3:1.

This matches the given spine-leaf oversubscription ratio, confirming that the leaf-level ratio is 3:1.

Exam trap

Cisco often tests the distinction between per-port bandwidth and total bandwidth, and the trap here is that candidates might incorrectly calculate the ratio by comparing the number of ports (48:4 = 12:1) instead of the aggregate bandwidth, or they might misinterpret the given 3:1 spine-leaf ratio as the leaf-level ratio without performing the calculation.

How to eliminate wrong answers

Option A is wrong because 1:1 would require the total uplink bandwidth to equal the total server bandwidth (480 Gbps), but the uplinks only provide 160 Gbps. Option B is wrong because 4:1 would imply 640 Gbps of server bandwidth for 160 Gbps of uplink bandwidth, which is not the case here. Option C is wrong because 2:1 would require 320 Gbps of uplink bandwidth, but the actual uplink capacity is only 160 Gbps.

Practice this question →